Skip to content
Español Log inCreate account Menu

OpenWAF Tasks

Scheduled tasks for your scripts and agents, every write approved.

OpenWAF Tasks runs your JavaScript or an AI agent on a schedule, in a declared OpenWAF Browsers Chrome. It reads freely. To post, submit or delete, it proposes the exact steps, and nothing happens until a person approves them.

Open the dashboardRead the docs

Public beta | Free within quota

Human approval of the exact action

Hosted in Germany

One real approval on production, 29 October 2026: the demo task’s log and screenshots, its proposal on the dashboard’s approvals screen (fed with that same approval), the steps the runner replayed and the page they ended on (httpbin.org/post), and the 409 an approval with another hash got.

How it works

Read on a schedule, write only what a person approved

A run prepares with a read-only browser. Anything that would change a site becomes a proposal.

  1. 1

    Schedule

    cron | run now

    A 5-field cron with a time zone, a single time, or a manual run. Each run opens a new browser of the task’s OpenWAF Browsers key.

  2. 2

    Prepare, read-only

    GET | HEAD | OPTIONS

    Your script or the agent reads pages freely. Every other request fails and is logged as blocked.

  3. 3

    Approve the exact action

    payload_sha256

    The task proposes typed steps with a summary, the target and a screenshot. A person approves that exact list, bound by its SHA-256.

  4. 4

    Act

    runner replays

    A new browser replays only the approved steps. Neither your code nor the model runs, and writes reach only the action’s domain.

Approval

You approve the steps, not a description

What you see in the approvals inbox is exactly what will run. Any change is a new approval.

  • Typed steps

    Up to 50 steps: goto, click, fill, type, press, select, check, wait_for, wait, assert_url and assert_text. The first is always goto.

  • Bound by a hash

    OpenWAF stores the SHA-256 of the steps. To approve you send it back; if it differs, the answer is 409 payload_changed. The runner checks it again before acting.

  • Expires

    A proposal nobody decides on expires after 2 hours by default. Nothing runs without a decision.

  • On the domains you allowed

    Each task lists the domains it may visit. Steps outside them are refused when they are proposed.

  • Paced per domain

    At most 20 approved actions a day and one every 2 minutes per domain. A task can set stricter limits.

  • From anywhere

    Approve or reject in the dashboard, on a phone, with the API, the CLI or MCP. A signed webhook can tell you when a proposal is waiting.

Use cases

What teams use it for

Jobs a person would otherwise do in a browser, on a schedule, with a record of every run.

  • Scheduled QA checks

    Open your public pages every day, check what they show, keep screenshots and report what broke. No writes needed.

  • Posting and forms, with approval

    Prepare a comment, a listing or a form submission. It goes out only after you read the exact steps and approve them.

  • Agent research

    Give an agent a goal, a model and a step budget. It reads the sites you allow and returns a report as the run’s output.

Declared

Declared, not disguised

Tasks run in OpenWAF Browsers, so sites see an agent that says what it is.

What it does

  • Uses Google Chrome as Google ships it, with requests signed with Web Bot Auth.
  • Stays on the domains the task lists.
  • Keeps logs, screenshots and the blocked requests of every run.
  • Runs on our servers in Germany.

What it will not do

  • Spoof fingerprints or hide that it is automated
  • Solve CAPTCHAs or other checks meant for people
  • Post, submit or delete anything without a person’s approval
  • Route traffic through residential or per-country proxies

Security

Your code and the model in a box

A task runs untrusted inputs on purpose: your code, a model and pages written by anyone.

  • No network, no secrets

    The script or the agent runs in a container with no network, a read-only file system, no Linux capabilities and no credentials. It reaches the browser only through the runner.

  • A model token per run

    An agent calls its model through OpenWAF Egress. Its token is rotated when the run starts and when it ends, and never enters the container.

  • Page content is data

    The agent is told never to follow instructions from pages. If it is fooled anyway, the read-only browser blocks the write and the proposal still waits for a person.

Public beta

Free within the quota

Subject to approval. These are the default limits per organization; we can adjust them.

  • 200runs a month
  • 5tasks per organization
  • 1run at a time

Runs last up to 30 minutes and an agent takes up to 50 steps. Browser time counts against your OpenWAF Browsers quota. A run waiting for approval has no browser and does not count as running. Screenshots are kept for 30 days.

Quickstart

A script that asks before it writes

The script reads the page and proposes the steps. You approve them, and the runner replays them.

  1. 1

    Write the task

    task.approve records the proposal; the browser stays read-only.

    export default async function ({ page, task }) {
  await page.goto(task.input.url);
  await task.screenshot("before");
  await task.approve({
    summary: "Sign the guestbook",
    target: task.input.url,
    steps: [
      { op: "goto", url: task.input.url },
      { op: "fill", selector: "#message", text: task.input.message },
      { op: "click", selector: "#sign" },
    ],
  });
}
  2. 2

    Approve the exact steps

    Or from the dashboard’s approvals inbox, with the same hash.

    $ openwaf-cloud ctl tasks approvals acme -status pending
guestbook  Sign the guestbook  example.com
  payload_sha256 9c1e…

$ openwaf-cloud ctl tasks approve acme <approval> \
    -sha256 9c1e… -reason "Text checked"

Next: the script quickstart, the agent quickstart, approvals and the limits.

Rules of use

What it is not for

What tasks may not do. We may pause a task or an organization without notice for abuse.

Not allowed

  • Spam, or posting the same or similar content in bulk
  • Creating accounts, or fake reviews, votes, clicks and followers
  • Scraping that a site’s terms or its robots.txt forbid
  • Getting around CAPTCHAs, logins, paywalls or rate limits
  • Approving actions you have not read, or on accounts you may not use

The full rules are in the acceptable use addendum, pending legal review. The Browsers addendum applies too. Report abuse to abuse@openwaf.dev.

Links

FAQ

OpenWAF Tasks questions

Can a task post without me?

No. While it prepares the browser is read-only, and writes only happen when a person approves the exact steps. An automatic policy exists only for internal, non-public targets, and only an operator can set it.

What if a page tries to trick the agent?

Page content is treated as data, and the agent is told never to follow it. Even if it does, it cannot write: the request is blocked and any proposal waits for a person.

Script or agent?

A script is your own JavaScript with the Playwright API, for jobs you can describe step by step. An agent works toward a goal you write, with the model you choose through OpenWAF Egress.

How do I get access?

Your organization needs OpenWAF Browsers first. Then ask from the Tasks section of the dashboard or write to support@openwaf.dev. Every owner and admin needs a verified e-mail and two-factor authentication.

What does it cost?

Nothing during the public beta, within the quota: 200 runs a month, 5 tasks and 1 run at a time per organization. Browser time counts against the Browsers quota. Nothing is charged.

Let your agents do the work and keep the last word.

OpenWAF Tasks is in public beta: free within the quota, subject to approval. Ask for access from the dashboard.

Open the dashboardRead the docs