# Kernel

Cloud Chromium browsers for AI agents, controlled over CDP, Playwright or an API, with proxies, logins and replays.

- Provider: Kernel (kernel.sh) (https://www.kernel.sh)
- Category: Drive a browser
- Type: Hosted browser
- Pricing model: Monthly plan fee plus usage billed per second of browser memory; no charge while a browser is idle [1]
- Free tier: Free plan (named Developer in the docs): $0 a month plus usage, $5 of credits a month, 5 concurrent browsers [1]
- Authentication: API key; OAuth 2.1 for the MCP server [6]
- Connect via: REST API, SDKs (TypeScript, Python, Go), CLI, hosted MCP server, CDP/Playwright [1]
- Read from the provider's pages on 2026-11-04
- Page: https://supermarket.dev/tools/drive-a-browser/kernel

## Pricing

### Billing
- Pricing model: Monthly plan fee plus usage per second of browser memory; idle (standby) time is free [2]
- Free tier: Developer plan: $0 a month plus usage, with $5 of included credits a month [2]
- Card required for free tier: Not published
- Minimum spend: Not published
- Billing period: Monthly platform fee; usage billed per second [1]
- Spending caps: Organization and project caps pause new usage at 100% [2]

### Prices
Per browser-hour = price per second x 3,600. Headless 0.0000166667 x 3,600 = $0.06; headful 0.0001333336 x 3,600 = $0.48; headful + GPU 0.0008000016 x 3,600 = $2.88. Headful is the default (features page). Browsers default to 8 GB memory headful.
- Headful browser (default), per browser-hour: $0.48 [2]
- Headless browser, per browser-hour: $0.06 [2]
- Headful browser + GPU acceleration, per browser-hour: $2.88 [2]
- Advertised rate (other page): $0.0000166667 per GB-second of browser memory [1]
- App invocation, per hour: $0.24 (0.0000666668 x 3,600) [2]

### Plans
| Plan | Monthly cost | Included credits / mo | Concurrent browsers |
|---|---|---|---|
| Developer | Free + usage | $5 | 5 |
| Hobbyist | $30 + usage | $10 | 10 |
| Start-Up | $200 + usage | $50 | 150 |
| Enterprise | Custom | Custom | Custom |
Source [2]

### Pay per call
- Machine payments protocol (no account): $0.50 for one stealth, headful browser for 30 minutes [23]

## Tools

### MCP server
- Official MCP server: Yes, remote [4]
- Address or package: `https://mcp.onkernel.com/mcp` (streamable HTTP); stdio via `npx -y mcp-remote https://mcp.onkernel.com/mcp` [5]
- tools/list without credentials: HTTP 401 `invalid_token`; the tool list was read from the docs instead [32]

### MCP tools
Read from the docs tool pages, because tools/list needs a token. The docs also list profile, proxy and app tools. readOnlyHint is not stated on the docs pages.
| Tool | What it does | Read-only |
|---|---|---|
| `manage_browsers` | Create, list, get and delete browser sessions | Not stated |
| `computer_action` | Mouse, keyboard and screenshot controls for a browser session | Not stated |
| `execute_playwright_code` | Run Playwright/TypeScript code against an existing browser session | Not stated |
| `manage_replays` | Start, stop and list video replay recordings for a session | Not stated |
| `browser_repl` | Run persistent JavaScript with browser helpers, WebMCP, CDP and Playwright | Not stated |
| `webmcp` | Discover (`list`) and call (`invoke`) tools that websites register in the browser | Not stated |
Source [4]

### API
Base `https://api.onkernel.com`, from the OpenAPI file.
| Endpoint | What it does |
|---|---|
| `POST /browsers` | Create a browser session |
| `GET /browsers` | List browser sessions |
| `DELETE /browsers/{id_or_name}` | Delete a browser session |
| `POST /browsers/{id_or_name}/playwright/execute` | Run Playwright code in the session |
| `POST /browsers/{id_or_name}/computer/click_mouse` | Mouse, keyboard, scroll and screenshot controls under `/computer/` |
| `POST /browsers/{id_or_name}/replays` | Start a replay recording |
| `POST /browser_pools/{id_or_name}/acquire` | Take a ready browser from a pool |
| `POST /auth/connections` | Create a managed auth connection for a profile and domain |
Source [30]

### Features
- Where the browser runs: Cloud, in isolated VMs; regions `us-east` (default), `eu-west`, `ap-southeast` on Start-Up and Enterprise [21]
- Browsers: Chromium; headful by default, with headless and GPU options [17]
- Max session length: 72 hours (`timeout_seconds` max 259200; default 60); limit counts inactivity [3]
- Concurrent sessions: 5 Developer, 10 Hobbyist, 150 Start-Up, custom Enterprise [3]
- Proxies: ISP, residential, mobile or bring-your-own; configurable proxies from Hobbyist, own proxies from Start-Up [17]
- CAPTCHA solving: Yes, in stealth mode (managed solver, can be opted out) [17]
- Session recording: Yes, mp4 replays on headful browsers; kept 1, 7 or 30 days by plan [20]
- Persistent logins: Yes, via profiles (cookies, storage, tabs); also managed auth and vaults [19]
- Live view: Yes, a URL for a person to watch and take over [29]
- Browser pools: Start-Up and Enterprise (the pricing page lists pools on every plan) [22]
- Browser pools (other page): Listed on all four plans [2]

## Authentication

### Methods
| Method | Used for | How |
|---|---|---|
| API key | REST API, SDKs, CLI and MCP server | Create a key in the dashboard; set `KERNEL_API_KEY`; MCP accepts `Authorization: Bearer <key>` |
| OAuth 2.1 | Hosted MCP server | Browser authorisation when a client connects |
| Email one-time code | Agent-assisted API key creation | `POST https://api.onkernel.com/authmd/agent/auth`, then a code from the account holder's email |
| Machine payments protocol | One paid browser with no account or key | `POST /mpp/browsers`, `402` challenge, pay with Link by Stripe |
Source [15]

### Getting access
- Who creates the account: A person approves; an agent can start registration, but the account holder must give it the emailed one-time code [14]
- Where to get a key: Dashboard at `https://dashboard.onkernel.com` [15]
- Other requirements: Not published
- Without an account: Pay with Link by Stripe; no KERNEL account or API key needed [23]
- Anonymous accounts: Not supported [14]

## Setup

### Addresses
- REST API: `https://api.onkernel.com` [1]
- MCP server: `https://mcp.onkernel.com/mcp` [1]
- OpenAPI spec: `https://www.kernel.sh/openapi.json` (OpenAPI 3.1) [1]
- Docs for agents: `https://www.kernel.sh/llms.txt`; docs index `https://www.kernel.sh/docs/llms.txt` [15]
- Status page: `https://api.onkernel.com/status` (JSON, returned "operational" today) [1]

### Install
| What | Command |
|---|---|
| MCP server in Claude Code | `claude mcp add --transport http kernel https://mcp.onkernel.com/mcp` |
| MCP server via the CLI | `kernel mcp install --target claude-code` |
| MCP over stdio | `npx -y mcp-remote https://mcp.onkernel.com/mcp` |
| TypeScript SDK | `npm install @onkernel/sdk` |
| Python SDK | `pip install kernel` |
| Go SDK | `go get github.com/kernel/kernel-go-sdk` |
| CLI (Homebrew) | `brew install kernel/tap/kernel` |
| CLI (npm) | `npm install -g @onkernel/cli` |
Source [15]

## Limits

### Rate limits
- API requests: Per organisation, per minute; the number is not published. Over the limit returns `429` with `Retry-After` [3]
- Browser creation: Rate limited separately from concurrency; acquiring from a pool is not subject to it [3]
- Rate limit numbers: Not published

### Other limits
- Concurrent browsers: 5 / 10 / 150 / custom by plan; standby browsers and reserved pool capacity count [3]
- Memory per browser: Headful 8 GB (default) or 16 GB; headless 1, 2 or 4 GB [3]
- Idle timeout: Default 60 s, max 72 h; billing stops after 5 s of inactivity (standby) [2]
- App invocations: 5 / 10 / 50 / custom by plan [3]
- Managed auth health check interval: 6 hours / 1 hour / 20 minutes minimum by plan [3]
- Replay retention: 1 day / 7 days / 30 days / custom by plan [2]

## Privacy

### Your data
- Data location: United States; browsers can run in `us-east`, `eu-west` or `ap-southeast` on Start-Up and Enterprise [26]
- Retention: Replays kept 1 to 30 days by plan; profile state is stored encrypted until deleted [2]
- Used for training: Not published
- Zero data retention: Enterprise only, per organisation; recordings, live view streams and telemetry are not kept after the browser ends [24]
- Encryption: TLS 1.2+ in transit, AES-256 at rest; profiles encrypted with a per-organisation key [25]

### Compliance
- Certifications: SOC 2 Type II on every plan; PCI DSS Level 4 (SAQ A) [1]
- ISO 27001 and GDPR: In progress [25]
- Certifications (other page): The same page opens by saying it holds active certifications across SOC 2 Type II, HIPAA, ISO 27001 and GDPR [25]
- HIPAA: Supported on Enterprise, with a signed BAA [28]

## Sources

1. Kernel llms.txt: https://www.kernel.sh/llms.txt
2. Pricing: https://www.kernel.sh/docs/info/pricing.md
3. Concurrency and limits: https://www.kernel.sh/docs/browsers/concurrency-and-limits.md
4. MCP server: https://www.kernel.sh/docs/reference/mcp-server.md
5. MCP transports: https://www.kernel.sh/docs/reference/mcp-server/transports.md
6. MCP authentication: https://www.kernel.sh/docs/reference/mcp-server/authentication.md
7. MCP: Claude: https://www.kernel.sh/docs/reference/mcp-server/clients/claude.md
8. MCP tool manage_browsers: https://www.kernel.sh/docs/reference/mcp-server/tools/manage-browsers.md
9. MCP tool computer_action: https://www.kernel.sh/docs/reference/mcp-server/tools/computer-action.md
10. MCP tool execute_playwright_code: https://www.kernel.sh/docs/reference/mcp-server/tools/execute-playwright-code.md
11. MCP tool manage_replays: https://www.kernel.sh/docs/reference/mcp-server/tools/manage-replays.md
12. MCP tool browser_repl: https://www.kernel.sh/docs/reference/mcp-server/tools/browser-repl.md
13. MCP tool webmcp: https://www.kernel.sh/docs/reference/mcp-server/tools/webmcp.md
14. API authentication (auth.md): https://www.kernel.sh/auth.md
15. Quickstart: https://www.kernel.sh/docs/start/quickstart.md
16. CLI: https://www.kernel.sh/docs/reference/cli.md
17. Features: https://www.kernel.sh/docs/overview/features.md
18. Stealth mode: https://www.kernel.sh/docs/browsers/bot-detection/stealth.md
19. Profiles: https://www.kernel.sh/docs/browsers/profiles.md
20. Replays: https://www.kernel.sh/docs/browsers/replays.md
21. Regional browsers: https://www.kernel.sh/docs/browsers/regions.md
22. Browser pools: https://www.kernel.sh/docs/browsers/pools.md
23. Buy a browser with MPP: https://www.kernel.sh/docs/info/mpp.md
24. Zero data retention: https://www.kernel.sh/docs/info/zero-data-retention.md
25. Security practices: https://www.kernel.sh/docs/security.md
26. Privacy policy: https://www.kernel.sh/docs/privacy.md
27. Terms of service: https://www.kernel.sh/docs/tos.md
28. HIPAA: https://www.kernel.sh/docs/info/hipaa.md
29. Live view: https://www.kernel.sh/docs/browsers/live-view.md
30. OpenAPI spec: https://www.kernel.sh/openapi.json
31. Data processing addendum: https://www.kernel.sh/docs/dpa.md
32. Checked by supermarket.dev