The Kernel CLI is a fast, friendly command‑line interface for Kernel — the platform that provides sandboxed, ready‑to‑use Chrome browsers for browser automations and web agents.

Sign up at kernel.sh and read the docs.

Kernel provides sandboxed, ready-to-use Chrome browsers for browser automations and web agents. This CLI helps you deploy apps, run actions, manage browsers, and access live views.

• Create new Kernel applications from templates
• Deploy and version apps to Kernel
• Invoke app actions (sync or async) and stream logs
• Create, list, view, and delete managed browser sessions
• Get a live view URL for visual monitoring and remote control

Install the Kernel CLI using your favorite package manager:

Verify the installation:

1. Create a new Kernel app:

   kernel create

2. Authenticate with Kernel:

   kernel login

3. Deploy your app:

   kernel deploy index.ts

4. Invoke your app:

   kernel invoke my-app action-name --payload '{"key": "value"}'

The easiest way to authenticate is using OAuth:

This opens your browser to complete the authentication flow. Your credentials are securely stored and automatically refreshed.

You can also authenticate using an API key:

Create an API key from the Kernel dashboard.

• --version, -v - Print the CLI version
• --no-color - Disable color output
• --log-level <level> - Set log level (trace, debug, info, warn, error, fatal, print)

Many commands support JSON output for scripting and automation. Use --output json or -o json to get machine-readable output:

Commands with JSON output support:

• Browsers: create, list, get, view
• Browser Pools: create, list, get, update, acquire
• Profiles: create, list, get
• Extensions: upload, list
• Proxies: create, list, get
• API Keys: create, list, get, update
• Apps: list, history
• Deploy: deploy (JSONL streaming), history
• Invoke: invoke (JSONL streaming), history
• Browser Sub-commands: replays list/start, process exec/spawn, fs file-info/list-files
• Browser NDJSON streaming: telemetry stream

• kernel login [--force] - Login via OAuth 2.0
• kernel logout - Clear stored credentials
• kernel auth - Check authentication status

• --name <name>, -n - Name of the application
• --language <language>, -l - Sepecify app language: typescript, or python
• --template <template>, -t - Template to use:
  • sample-app - Basic template with Playwright integration
  • captcha-solver - Template demonstrating Kernel's auto-CAPTCHA solver
  • stagehand - Template with Stagehand SDK (TypeScript only)
  • browser-use - Template with Browser Use SDK (Python only)
  • anthropic-computer-use - Anthropic Computer Use prompt loop
  • openai-computer-use - OpenAI Computer Use Agent sample
  • gemini-computer-use - Implements a Gemini computer use agent (TypeScript only)
  • openagi-computer-use - OpenAGI Lux computer-use models (Python only)
  • magnitude - Magnitude framework sample (TypeScript only)
  • claude-agent-sdk - Claude Agent SDK browser automation agent

• kernel deploy <file> - Deploy an app to Kernel

  • --version <version> - Specify app version (default: latest)
  • --force - Allow overwriting existing version
  • --env <KEY=VALUE>, -e - Set environment variables (can be used multiple times)
  • --env-file <file> - Load environment variables from file (can be used multiple times)
  • --output json, -o json - Output JSONL (one JSON object per line for each event)

• kernel deploy logs <deployment_id> - Stream logs for a deployment

  • --follow, -f - Follow logs in real-time (stream continuously)
  • --since, -s - How far back to retrieve logs. Duration formats: ns, us, ms, s, m, h (e.g., 5m, 2h, 1h30m). Timestamps also supported: 2006-01-02, 2006-01-02T15:04, 2006-01-02T15:04:05, 2006-01-02T15:04:05.000
  • --with-timestamps, -t - Include timestamps in each log line

• kernel deploy history [app_name] - Show deployment history

  • --limit <n> - Max deployments to return (default: 100; 0 = all)
  • --output json, -o json - Output raw JSON array

• kernel invoke <app> <action> - Run an app action

  • --version <version>, -v - Specify app version (default: latest)
  • --payload <json>, -p - JSON payload for the action
  • --payload-file <path>, -f - Read JSON payload from a file (use - for stdin)
  • --sync, -s - Invoke synchronously (timeout after 60s)
  • --output json, -o json - Output JSONL (one JSON object per line for each event)

• kernel app list - List deployed apps

  • --name <app_name> - Filter by app name
  • --version <version> - Filter by version
  • --output json, -o json - Output raw JSON array

• kernel app history <app_name> - Show deployment history for an app

  • --limit <n> - Max deployments to return (default: 100; 0 = all)
  • --output json, -o json - Output raw JSON array

• kernel logs <app_name> - View app logs
  • --version <version> - Specify app version (default: latest)
  • --follow, -f - Follow logs in real-time
  • --since <time>, -s - How far back to retrieve logs (e.g., 5m, 1h)
  • --with-timestamps - Include timestamps in log output

• kernel browsers list - List running browsers
  • --query <q> - Search by name, session ID, profile ID, proxy ID, or pool name
  • --tag <KEY=VALUE> - Filter by tag, repeatable; a session must match every pair
  • --output json, -o json - Output raw JSON array
• kernel browsers create - Create a new browser session
  • -s, --stealth - Launch browser in stealth mode to avoid detection
  • -H, --headless - Launch browser without GUI access
  • --kiosk - Launch browser in kiosk mode
  • --start-url <url> - Initial page to open on launch
  • --name <name> - Optional unique name for the session (used to find it later by name; can be changed with browsers update --name)
  • --tag <KEY=VALUE> - Set a tag on the session, repeatable; up to 50 pairs
  • --pool-id <id> - Acquire a browser from the specified pool (mutually exclusive with --pool-name; ignores other session flags). --name/--tag still apply to the acquired session.
  • --pool-name <name> - Acquire a browser from the pool name (mutually exclusive with --pool-id; ignores other session flags)
  • --telemetry=all - Enable telemetry for all categories
  • --telemetry=off - Disable telemetry
  • --telemetry=<list> - Per-category config, e.g. --telemetry=network=on,page=off
  • --chrome-policy <json> - Custom Chrome enterprise policy as a JSON object. Kernel-managed policies (extensions, proxy, automation) are rejected server-side.
  • --chrome-policy-file <path> - Read the Chrome enterprise policy from a file (use - for stdin). Mutually exclusive with --chrome-policy.
  • --output json, -o json - Output raw JSON object
  • Note: When a pool is specified, omit other session configuration flags—pool settings determine profile, proxy, viewport, etc.
• kernel browsers delete <id-or-name> - Delete a browser by ID or name
• kernel browsers view <id-or-name> - Get live view URL for a browser by ID or name
  • --output json, -o json - Output JSON with liveViewUrl
• kernel browsers get <id-or-name> - Get detailed browser session info by ID or name
  • --output json, -o json - Output raw JSON object
• kernel browsers update <id-or-name> - Update a running browser session by ID or name
  • --name <name> - Set a new unique name for the session (mutually exclusive with --clear-name)
  • --clear-name - Clear the session name
  • --tag <KEY=VALUE> - Set a tag, repeatable; up to 50 pairs. Replaces the entire tag set (not merged); mutually exclusive with --clear-tags
  • --clear-tags - Remove all tags from the session
  • --telemetry=all - Enable telemetry for all categories
  • --telemetry=off - Disable telemetry
  • --telemetry=<list> - Per-category config, e.g. --telemetry=network=on,page=off
  • --output json, -o json - Output raw JSON object
• kernel browsers curl <id> <url> - Make HTTP requests through a browser session's Chrome network stack
  • -X, --request <method> - HTTP method (default: GET; defaults to POST when --data is set)
  • -H, --header <header> - HTTP header, repeatable ("Key: Value" format)
  • -d, --data <body> - Request body
  • --data-file <path> - Read request body from file
  • --max-time <seconds> - Maximum time allowed for the request (default: 30)
  • -o, --output <path> - Write response body to file
  • -I, --head - Fetch headers only
  • -i, --include - Include response headers in output
  • -D, --dump-header <path> - Write received headers to file (use - for stdout)
  • -w, --write-out <format> - Output text after completion; supports %{http_code}, %{response_code}, %{time_total}, and %{size_download}
  • -f, --fail - Fail with no body output on HTTP errors
  • -s, --silent - Suppress progress output
  • Note: redirects are followed automatically by Chromium.

• kernel browser-pools list - List browser pools
  • --output json, -o json - Output raw JSON array
• kernel browser-pools create - Create a browser pool
  • --name <name> - Optional unique name for the pool
  • --size <n> - Number of browsers in the pool (required)
  • --fill-rate <n> - Percentage of the pool to fill per minute
  • --timeout <seconds> - Idle timeout for browsers acquired from the pool
  • --stealth, --headless, --kiosk - Default pool configuration
  • --profile-id, --profile-name, --proxy-id, --start-url, --extension, --viewport - Same semantics as kernel browsers create
  • --chrome-policy <json> / --chrome-policy-file <path> - Custom Chrome enterprise policy applied to every browser in the pool, as a JSON object or from a file (- for stdin). Same semantics as kernel browsers create.
  • --output json, -o json - Output raw JSON object
• kernel browser-pools get <id-or-name> - Get pool details
  • --output json, -o json - Output raw JSON object
• kernel browser-pools update <id-or-name> - Update pool configuration
  • Same flags as create plus --clear-start-url (remove the pool's start URL) and --discard-all-idle (discard all idle browsers and refill). An empty --chrome-policy '{}' is ignored and does not clear an existing policy; recreate the pool to remove one.
  • --output json, -o json - Output raw JSON object
• kernel browser-pools delete <id-or-name> - Delete a pool
  • --force - Force delete even if browsers are leased
• kernel browser-pools acquire <id-or-name> - Acquire a browser from the pool
  • --timeout <seconds> - Acquire timeout before returning 204
  • --name <name> - Optional name for the acquired session (applies to this lease; cleared on release)
  • --tag <KEY=VALUE> - Set a tag on the acquired session, repeatable; applies to this lease
  • --output json, -o json - Output raw JSON object
• kernel browser-pools release <id-or-name> - Release a browser back to the pool
  • --session-id <id> - Browser session ID to release (required)
  • --reuse - Reuse the browser instance (default: true)
• kernel browser-pools flush <id-or-name> - Destroy all idle browsers in the pool

• kernel browsers logs stream <id> - Stream browser logs
  • --source <source> - Log source: "path" or "supervisor" (required)
  • --follow - Follow the log stream (default: true)
  • --path <path> - File path when source=path
  • --supervisor-process <name> - Supervisor process name when source=supervisor. Most useful value is "chromium"

• kernel browsers replays list <id> - List replays for a browser
  • --output json, -o json - Output raw JSON array
• kernel browsers replays start <id> - Start a replay recording
  • --framerate <fps> - Recording framerate (fps)
  • --max-duration <seconds> - Maximum duration in seconds
  • --output json, -o json - Output raw JSON object
• kernel browsers replays stop <id> <replay-id> - Stop a replay recording
• kernel browsers replays download <id> <replay-id> - Download a replay video
  • -f, --output-file <path> - Output file path for the replay video

Telemetry config is a sub-field of the browser session. Use browsers create or browsers update to enable, disable, or configure it, and browsers get to inspect the current state.

• Enable the default set: kernel browsers update <id> --telemetry=all
• Disable: kernel browsers update <id> --telemetry=off
• Capture specific categories: kernel browsers update <id> --telemetry=console,network (any of: console, network, page, interaction, control, connection, system, screenshot, captcha)

Per-category updates are partial — only categories you name are changed; others retain their current state. --telemetry=all and --telemetry=off reset the entire config.

• kernel browsers telemetry stream <id> - Stream live telemetry events (NDJSON with -o json)
  • --categories <list> - Filter by event category (console, network, page, interaction, control, connection, system, screenshot, captcha, monitor)
  • --types <list> - Filter by event type (e.g. network_response, console_error)
  • --seq <n> - Resume after sequence number N (Last-Event-ID); replays events with seq > N. Omit to stream from now.
  • --replay all - Replay buffered events on connect, starting from the oldest retained event (mutually exclusive with --seq)
  • -o, --output json - Output newline-delimited JSON envelopes
  • Default output: tab-separated <time>\t[<category>]\t<type>, e.g. 15:04:05 [network] network_response
• kernel browsers telemetry events <id> - Read historical telemetry events (paged)
  • --limit <n> - Maximum number of events per page (1-100, default 20)
  • --offset <cursor> - Pagination cursor: pass the X-Next-Offset from a previous response
  • --since <ts|dur> / --until <ts|dur> - Time window (RFC-3339 timestamp or duration like 5m). --since is ignored when --offset is set; --until still bounds the page
  • --categories <list> - Filter by event category (console, network, page, interaction, control, connection, system, screenshot, captcha, monitor); filtered server-side
  • --types <list> - Filter by event type (e.g. network_response, console_error); filtered client-side, so this walks every page in the window for complete results
  • --all - Walk every page in the window instead of just the first (ignores --offset; no next_offset is returned)
  • -o, --output json - Output { "events": [...], "next_offset": "..." } (omit next_offset when there is no next page)

• kernel browsers process exec <id> [--] [command...] - Execute a command synchronously
  • --command <cmd> - Command to execute (optional; if omitted, trailing args are executed via /bin/bash -c)
  • --args <args> - Command arguments
  • --cwd <path> - Working directory
  • --timeout <seconds> - Timeout in seconds
  • --as-user <user> - Run as user
  • --as-root - Run as root
  • --output json, -o json - Output raw JSON object
• kernel browsers process spawn <id> [--] [command...] - Execute a command asynchronously
  • --command <cmd> - Command to execute (optional; if omitted, trailing args are executed via /bin/bash -c)
  • --args <args> - Command arguments
  • --cwd <path> - Working directory
  • --timeout <seconds> - Timeout in seconds
  • --as-user <user> - Run as user
  • --as-root - Run as root
  • --output json, -o json - Output raw JSON object
• kernel browsers process kill <id> <process-id> - Send a signal to a process
  • --signal <signal> - Signal to send: TERM, KILL, INT, HUP (default: TERM)
• kernel browsers process status <id> <process-id> - Get process status
• kernel browsers process stdin <id> <process-id> - Write to process stdin (base64)
  • --data-b64 <data> - Base64-encoded data to write to stdin (required)
• kernel browsers process stdout-stream <id> <process-id> - Stream process stdout/stderr

• kernel browsers fs new-directory <id> - Create a new directory
  • --path <path> - Absolute directory path to create (required)
  • --mode <mode> - Directory mode (octal string)
• kernel browsers fs delete-directory <id> - Delete a directory
  • --path <path> - Absolute directory path to delete (required)
• kernel browsers fs delete-file <id> - Delete a file
  • --path <path> - Absolute file path to delete (required)
• kernel browsers fs download-dir-zip <id> - Download a directory as zip
  • --path <path> - Absolute directory path to download (required)
  • -o, --output <path> - Output zip file path
• kernel browsers fs file-info <id> - Get file or directory info
  • --path <path> - Absolute file or directory path (required)
  • --output json, -o json - Output raw JSON object
• kernel browsers fs list-files <id> - List files in a directory
  • --path <path> - Absolute directory path (required)
  • --output json, -o json - Output raw JSON array
• kernel browsers fs move <id> - Move or rename a file or directory
  • --src <path> - Absolute source path (required)
  • --dest <path> - Absolute destination path (required)
• kernel browsers fs read-file <id> - Read a file
  • --path <path> - Absolute file path (required)
  • -o, --output <path> - Output file path (optional)
• kernel browsers fs set-permissions <id> - Set file permissions or ownership
  • --path <path> - Absolute path (required)
  • --mode <mode> - File mode bits (octal string) (required)
  • --owner <user> - New owner username or UID
  • --group <group> - New group name or GID
• kernel browsers fs upload <id> - Upload one or more files
  • --file <local:remote> - Mapping local:remote (repeatable)
  • --dest-dir <path> - Destination directory for uploads
  • --paths <paths> - Local file paths to upload
• kernel browsers fs upload-zip <id> - Upload a zip and extract it
  • --zip <path> - Local zip file path (required)
  • --dest-dir <path> - Destination directory to extract to (required)
• kernel browsers fs write-file <id> - Write a file from local data
  • --path <path> - Destination absolute file path (required)
  • --mode <mode> - File mode (octal string)
  • --source <path> - Local source file path (required)

• kernel browsers extensions upload <id> <extension-path>... - Ad-hoc upload of one or more unpacked extensions to a running browser instance.

• kernel browsers computer click-mouse <id> - Click mouse at coordinates

  • --x <coordinate> - X coordinate (required)
  • --y <coordinate> - Y coordinate (required)
  • --num-clicks <n> - Number of clicks (default: 1)
  • --button <button> - Mouse button: left, right, middle, back, forward (default: left)
  • --click-type <type> - Click type: down, up, click (default: click)
  • --hold-key <key> - Modifier keys to hold (repeatable)

• kernel browsers computer move-mouse <id> - Move mouse to coordinates

  • --x <coordinate> - X coordinate (required)
  • --y <coordinate> - Y coordinate (required)
  • --hold-key <key> - Modifier keys to hold (repeatable)

• kernel browsers computer screenshot <id> - Capture a screenshot

  • --to <path> - Output file path for the PNG image (required)
  • --x <coordinate> - Top-left X for region capture (optional)
  • --y <coordinate> - Top-left Y for region capture (optional)
  • --width <pixels> - Region width (optional)
  • --height <pixels> - Region height (optional)

• kernel browsers computer type <id> - Type text on the browser instance

  • --text <text> - Text to type (required)
  • --delay <ms> - Delay in milliseconds between keystrokes (optional)

• kernel browsers computer press-key <id> - Press one or more keys

  • --key <key> - Key symbols to press (repeatable)
  • --duration <ms> - Duration to hold keys down in ms (0=tap)
  • --hold-key <key> - Modifier keys to hold (repeatable)

• kernel browsers computer scroll <id> - Scroll the mouse wheel

  • --x <coordinate> - X coordinate (required)
  • --y <coordinate> - Y coordinate (required)
  • --delta-x <pixels> - Horizontal scroll amount (+right, -left)
  • --delta-y <pixels> - Vertical scroll amount (+down, -up)
  • --hold-key <key> - Modifier keys to hold (repeatable)

• kernel browsers computer drag-mouse <id> - Drag the mouse along a path

  • --point <x,y> - Add a point as x,y (repeatable)
  • --delay <ms> - Delay before dragging starts in ms
  • --button <button> - Mouse button: left, middle, right (default: left)
  • --hold-key <key> - Modifier keys to hold (repeatable)

• kernel browsers playwright execute <id> [code] - Execute Playwright/TypeScript code against the browser
  • --timeout <seconds> - Maximum execution time in seconds (defaults server-side)
  • If [code] is omitted, code is read from stdin

• kernel extensions list - List all uploaded extensions
  • --output json, -o json - Output raw JSON array
• kernel extensions get <id-or-name> - Show extension metadata (id, name, created, size, last used)
  • --output json, -o json - Output raw JSON object
• kernel extensions upload <directory> - Upload an unpacked browser extension directory
  • --name <name> - Optional unique extension name
  • --output json, -o json - Output raw JSON object
• kernel extensions download <id-or-name> - Download an extension archive
  • --to <directory> - Output directory (required)
• kernel extensions download-web-store <url> - Download an extension from the Chrome Web Store
  • --to <directory> - Output directory (required)
  • --os <os> - Target OS: mac, win, or linux (default: linux)
• kernel extensions delete <id-or-name> - Delete an extension by ID or name
  • -y, --yes - Skip confirmation prompt

• kernel proxies list - List proxy configurations

  • --output json, -o json - Output raw JSON array

• kernel proxies get <id> - Get a proxy configuration by ID

  • --output json, -o json - Output raw JSON object

• kernel proxies create - Create a new proxy configuration

  • --output json, -o json - Output raw JSON object

  • --name <name> - Proxy configuration name

  • --type <type> - Proxy type: datacenter, isp, residential, mobile, custom (required)

  • --protocol <http|https> - Protocol to use (default: https)

  • --country <code> - ISO 3166 country code or "EU" (location-based types)

  • --city <name> - City name (no spaces, e.g. sanfrancisco) (residential, mobile; requires --country)

  • --state <code> - Two-letter state code (residential, mobile)

  • --zip <zip> - US ZIP code (residential)

  • --asn <asn> - Autonomous system number (e.g., AS15169) (residential)

  • --os <os> - Operating system: windows, macos, android (residential)

  • --host <host> - Proxy host (custom; required)

  • --port <port> - Proxy port (custom; required)

  • --username <username> - Username for proxy authentication (custom)

  • --password <password> - Password for proxy authentication (custom)

• kernel proxies delete <id> - Delete a proxy configuration

  • -y, --yes - Skip confirmation prompt

Automated authentication for web services. The run command orchestrates the full auth flow automatically.

• kernel agents auth run - Run a complete authentication flow

  • --domain <domain> - Target domain for authentication (required)
  • --profile <name> - Profile name to use/create (required)
  • --value <key=value> - Field name=value pair (repeatable, e.g., --value username=foo --value password=bar)
  • --credential <name> - Existing credential name to use
  • --save-credential-as <name> - Save provided credentials under this name
  • --totp-secret <secret> - Base32 TOTP secret for automatic 2FA
  • --proxy-id <id> - Proxy ID to use
  • --login-url <url> - Custom login page URL
  • --allowed-domain <domain> - Additional allowed domains (repeatable)
  • --timeout <duration> - Maximum time to wait for auth completion (default: 5m)
  • --open - Open live view URL in browser when human intervention needed
  • --output json, -o json - Output JSONL events

• kernel agents auth create - Create an auth agent

  • --domain <domain> - Target domain for authentication (required)
  • --profile-name <name> - Name of the profile to use (required)
  • --credential-name <name> - Optional credential name to link
  • --login-url <url> - Optional login page URL
  • --allowed-domain <domain> - Additional allowed domains (repeatable)
  • --proxy-id <id> - Optional proxy ID to use
  • --output json, -o json - Output raw JSON object

• kernel agents auth list - List auth agents

  • --domain <domain> - Filter by domain
  • --profile-name <name> - Filter by profile name
  • --limit <n> - Maximum number of results to return
  • --offset <n> - Number of results to skip
  • --output json, -o json - Output raw JSON array

• kernel agents auth get <id> - Get an auth agent by ID

  • --output json, -o json - Output raw JSON object

• kernel agents auth delete <id> - Delete an auth agent

  • -y, --yes - Skip confirmation prompt

• kernel credentials create - Create a new credential

  • --name <name> - Unique name for the credential (required)
  • --domain <domain> - Target domain (required)
  • --value <key=value> - Field name=value pair (repeatable)
  • --sso-provider <provider> - SSO provider (google, github, microsoft)
  • --totp-secret <secret> - Base32-encoded TOTP secret for 2FA
  • --output json, -o json - Output raw JSON object

• kernel credentials list - List credentials

  • --domain <domain> - Filter by domain
  • --output json, -o json - Output raw JSON array

• kernel credentials get <id-or-name> - Get a credential by ID or name

  • --output json, -o json - Output raw JSON object

• kernel credentials update <id-or-name> - Update a credential

  • --name <name> - New name
  • --value <key=value> - Field values to update (repeatable)
  • --sso-provider <provider> - SSO provider
  • --totp-secret <secret> - TOTP secret
  • --output json, -o json - Output raw JSON object

• kernel credentials delete <id-or-name> - Delete a credential

  • -y, --yes - Skip confirmation prompt

• kernel credentials totp-code <id-or-name> - Get current TOTP code

  • --output json, -o json - Output raw JSON object

• kernel api-keys create - Create a new API key

  • --name <name> - API key name (required)
  • --days-to-expire <days> - Number of days until expiry (1-3650); omit for never
  • --project-id <project_id> - Create a project-scoped API key for this project ID; omit for org-wide. This is different from global --project, which only scopes the CLI request.
  • --output json, -o json - Output raw JSON object, including the one-time plaintext key

• kernel api-keys list - List API keys

  • --limit <n> - Maximum number of results to return
  • --offset <n> - Number of results to skip
  • --output json, -o json - Output raw JSON array

• kernel api-keys get <id> - Get an API key

  • --output json, -o json - Output raw JSON object

• kernel api-keys update <id> - Update an API key

  • --name <name> - New API key name
  • --output json, -o json - Output raw JSON object

• kernel api-keys delete <id> - Delete an API key

  • -y, --yes - Skip confirmation prompt

• kernel --help - Show all available commands
• kernel <command> --help - Get help for a specific command

For complete documentation, visit:

• 📖 Documentation
• 🚀 Quickstart Guide
• 📋 CLI Reference

• Discord Community
• GitHub Issues
• Documentation

For development and contribution information, see DEVELOPMENT.md.