[Dejo]
Dejo
A browser your AI agent remembers.
It learns a website once. Every run after that is one tool call, with zero model calls.
[PyPI]
[Python]
[Tests]
[MIT license]
Website ·
Install ·
Benchmark ·
Tools ·
What it can do ·
Compared ·
Contributing
Your AI can use websites. But it forgets how, every single time. Dejo makes it remember.
Dejo gives Claude Code, Codex, Cursor or any MCP client a browser with a memory. Your agent
walks a website once: signing in, clicking, reading. Dejo writes down the route. Every run
after that follows the route instead: one tool call, no page reading, zero model calls.
When the site changes, Dejo repairs the one step that moved and keeps the rest.
Install
Python 3.11 or newer.
Then connect it to your agent:
Dejo is one stdio server with no arguments, so any agent that can run an MCP server can use it.
No API key, no account. Dejo never calls a model. Your agent does the thinking, and the
memory is a local file on your machine.
Check the install at any time. It names anything missing and the command that fixes it:
Quick start
Ask your agent for something on a website, in your own words:
Go to github.com/microsoft/playwright and tell me how many open issues it has.
The first time, your agent learns it: Dejo opens the page and shows it, one line per control,
and your agent sends the steps back in one call (click link "Issues", then read ... as open issues). The read is what Dejo saves. Ask again tomorrow, in a brand-new chat, and it is one
call:
Prefer a terminal? Everything works without an MCP client:
How it works
What a route is
Not a recording, and not notes. Each step keeps:
- what it was for, in plain words:
"open this month's invoice"
- up to nine ways to find the control: test id, link target, label, role, placeholder,
alt text, title, visible text, CSS. Ranked by which have actually worked.
- a check that proves it landed: the address changed, the file downloaded, the field holds
what was typed, the row count is what it should be.
The checks are the difference between this and a macro recorder. A recorder clicks and hopes.
Dejo notices when a click did nothing, and says the site changed.
The nine locators are why most redesigns cost nothing: lose the CSS id, keep the label, and the
step still lands. If more than half the steps break, the site was rebuilt rather than adjusted.
Dejo throws the route away but keeps what it knows about the site (needs a login, sends a code
to your phone), so relearning is cheaper than the first visit.
The map
A route is one path through a site. Dejo also keeps a map: every page it has looked at,
and the controls that were on it. It costs nothing to keep, because the page had already been
read.
Ask for something new on a site Dejo has walked, and your agent is handed the pages it already
knows before it starts hunting. Each control comes back as a step target such as
button "Sign in", which works in a step without looking at the page first. A page Dejo has
already walked costs no reading at all. This matters most where one site carries many tasks: an end-to-end test
suite, an admin console, a portal you work in every day.
The map says when each page was seen. It is what was there last time, not a promise about now.
Measured on the demo site in this repo (python benchmarks/benchmark.py):
The time is mostly Dejo waiting for the site to finish after the last click (this task ends in
a download). A task that ends by reading its answer does not pay that wait.
Benchmark
19 tasks on 12 lesser-known websites, the kind a model cannot answer from memory: a
college course catalog, the Debian package directory, the RFC Editor, a museum's collection,
a Dart package registry, a small shop. Every right answer was written down before any tool
ran. Claude Sonnet 5 (medium), one fresh session per run, @playwright/[email protected].
- First run: 38% fewer tokens than Playwright MCP, 55% fewer than Playwright CLI.
- Every run after: 78% fewer tokens than Playwright MCP, and 17 of 19 repeats were a
single tool call. The same task run 10 times costs 74% fewer tokens.
Three things the table should also tell you, because they are true:
- On a typical task the first run costs about the same as Playwright MCP (median 216k vs
257k). The first-run savings come from the hard sites: 324k against 1.36M on the college
catalog, 398k against 983k on the museum's filters.
- 6 more tasks were on sites that block automated browsers (Cloudflare checks, plain 403s).
Dejo and Playwright MCP were stopped on all six; Playwright CLI got through two of them at
1.2M and 1.7M tokens. They are in the results file, not in the table.
- Dejo's numbers are from the release code, after fixing what this benchmark found; the
Playwright rows are from the same tasks and model, one day earlier.
Tasks: benchmarks/real_tasks.py. Results:
benchmarks/benchmark-real-2026-10-21.json (all three tools), -10-23.json and
-10-23-fixes.json (Dejo after the fixes). Run it yourself:
python benchmarks/benchmark_learning.py --bench real --tools dejo,playwright --runs 1.
Earlier: the same job ten times (Dejo 0.1.2)
The same job, done 10 times, each time in a brand-new chat. Three multi-step tasks on
well-known sites, three MCP browser tools, 90 fresh Claude sessions (Sonnet 5, medium):
@playwright/[email protected], [email protected].
52% fewer tool calls and 47% fewer tokens than Playwright MCP. Against Chrome DevTools
MCP: 36% fewer calls, 35% fewer tokens. Every tool answered in all 30 of its sessions.
The GitHub task, run by run:
Dejo pays once to learn the route, then costs two calls however many steps that route has.
Two things this table should also tell you, because they are true:
- Dejo costs the most on run 1. It does the job and learns the site. That is the trade.
- On a single page with a one-line answer, Dejo is not cheaper. Opening one page and reading
one line costs every tool two or three calls, and there is nothing left for memory to save.
Run it yourself: python benchmarks/benchmark_agents.py --journeys --runs 10. These results
were recorded while Dejo was still called Cairn, so the files say cairn where they mean Dejo.
Signing in
You sign in to a site once, by hand, in a real window:
Sign in however the site asks: a password, Google, a code on your phone. Dejo never types a
password for you and never automates an SSO button. When you say you are done, Dejo checks the
window first: if it still shows a sign-in page, it says so rather than pretending. The session
is kept, so you stay signed in.
A task learned while signed out keeps its sign-in steps. Replayed once you are signed in, the
site skips its sign-in page, so Dejo skips those steps too, says so, and runs the rest of the
task. A task that is only a sign-in answers that there is nothing to do.
Passwords never go into memory. A step that needs one records only that a password goes
there. The value is read at run time from an environment variable
(DEJO_SECRET_BILLING_ACME_COM_PASSWORD) or from ~/.dejo/secrets.json:
More than one identity at once
A profile is a whole signed-in browser: its own cookies, its own session. Keep as many as you
need, side by side:
From your agent, dejo_profile with name="vendor" switches, and without a name lists them. A suite
covering three roles never has to sign out and back in, so the order of the tests stops
mattering.
Sharing a route
Memory is per agent. Agents on one machine can hand routes to each other:
What travels: the steps, the ranked locators, the checks, the notes about the site, and the
map. What never travels: anything typed into a field, and which account was used. A shared
sign-in step asks the borrower for their own credentials.
When a borrower repairs a broken step, the fix can be contributed back to the original.
Forgetting
Dejo now has nothing to follow for that site, its map included. The next run says the memory is
gone. It does not quietly fall back to exploring. Forgetting also withdraws anything you shared
for that site, and Dejo will not quietly hand you somebody else's route for it afterwards: you
have to borrow it on purpose.
Where your data lives
All on your machine.
Being signed in is not the same as remembering. Forget a site and Dejo is still signed in, and
has no idea what to click.
The memory needs no account and has no size limit. History, the one part that grows with every
run, keeps the newest 10,000 events per agent. If you would rather keep your memory in
Sibyl Memory, install pip install "dejo[sibyl]"
and set DEJO_MEMORY=sibyl.
Tools
Five MCP tools. One of them, dejo_run, does all of the browsing, because every tool name is
read on every turn and tool choice is the most fragile part of an agent's day.
Steps are plain lines, run in order. Dejo stops at the first one that fails and shows the page
there, so the next call only sends the rest:
Targets are a ref from the page (e12), or role "name" (link "Travel"), text "...",
label "...", css "...". A name is matched whole first; when nothing has exactly that
name, words inside a name count, in any case, as in Playwright, so link "Belt Sander" finds
the card link "Belt Sander $73.59". Two such matches are refused, never guessed. The page is
searched first, then each iframe. Add first, last or nth 3 to mean a place in a list
rather than one item. A step that buys, pays, sends, deletes or submits is marked with !
(click! button "Pay"); unmarked, Dejo will not do it, and marked, it never runs twice on its
own.
Every step, in one place:
It handles what breaks recorded flows: shadow DOM, iframes, divs pretending to be buttons,
content that loads late, cookie banners, confirm dialogs, new tabs, and file pickers with no
visible input. A js step runs your own JavaScript when a site does something nobody
anticipated, and is deliberately never saved into a route, because a step made of code cannot
be repaired. The full capability list, with the reason for each choice, is in
docs/BROWSING.md. How Dejo compares with Playwright, Playwright MCP,
Chrome DevTools MCP, browser-use, Stagehand, Puppeteer and Selenium, capability by capability,
is in docs/CAPABILITIES.md.
Settings
Set these in the environment of dejo-mcp, in your agent's MCP config ("env": {...}), or
before a dejo command. All are optional.
When something goes wrong
Start with dejo doctor. It checks the browser, the profile, the memory and the downloads
folder, and prints the exact fix for anything missing.
"Dejo has no browser to drive yet." pip install brings the code, not a browser. Run
playwright install chromium.
"Dejo cannot open a window here: this machine has no screen." Signing in needs a real
window, so dejo login cannot work over plain SSH or in a container. Sign in on a computer with
a desktop and copy ~/.dejo/browser-profile across, or forward a display with ssh -X.
Normal runs are headless and unaffected.
"The browser profile ... is in use by another Dejo session." A profile can be open in one
browser at a time, and another Dejo run (another agent, another terminal) has it. The message
names that session's process. Close it, or work in another profile (dejo_profile with a new
name, or dejo --profile <name>).
"Dejo could not open its browser profile." Another Dejo run or sign-in window still has
it open, or the profile is in a state no browser accepts. Close any other run first. If that
was not it, deleting ~/.dejo/browser-profile fixes it, at the cost of signing you out.
To run two agents at once, give each its own profile: DEJO_PROFILE=~/.dejo/profile-b dejo-mcp.
"Nothing loads in Dejo's browser profile." A page timed out twice in the profile, Dejo
tried the same address in a fresh browser, and the site's real page loaded there (an error page
from a site that is down does not count). The site is fine; that profile is stuck. Switch to a
new profile (dejo --profile <name>, or dejo_profile from your agent) and sign in there.
Delete the profile folder the message names only if every site keeps timing out in it.
A site shows the wrong country, currency or date format. Dejo's browser tells sites the
language and region this machine is set to (on Linux and macOS, from LANG), and Chrome uses
the machine's own time zone. To choose another, set DEJO_LOCALE, like DEJO_LOCALE=en-IN.
A captcha. Dejo stops and says so. It does not mark the route broken and does not try to
solve it. Clear it yourself once, and run again.
Coming from Cairn
Dejo was called Cairn until October 2026. On first start, Dejo moves an old ~/.cairn
folder to ~/.dejo, so every sign-in is kept, and copies the old memory across from Sibyl
Memory into ~/.dejo/memory.db, so every learned site is kept. The Sibyl file itself is left
as it was. The old CAIRN_* environment variables still work, and the old
cairn-browser-mcp package installs Dejo.
Development
Opening Claude Code inside the clone needs no setup: the checked-in .mcp.json offers the
server straight away.
FAQ
Is Dejo a cache? No. A cache replays and hopes. Every step Dejo saves carries a check that
proves it landed, so Dejo can tell a changed site from a working one and fix only the step that
moved.
Does it call an AI model? No. Replay is plain code with zero model calls, and there is no
API key to set. The agent you already use does the thinking, on the first run and when a step
needs fixing.
Is it cheaper on every task? No. The first run costs the most, because Dejo does the job and
learns the route. On a single page with a one-line answer there is nothing to remember. It pays
off on tasks with steps that you run again.
Does it store my passwords? No. You sign in yourself, in a real window. A step that needs a
password records only that a password goes there.
Which agents does it work with? Any agent that can run an MCP server: Claude Code, Codex,
Cursor, and others.
Contributing
Bug reports, sites Dejo gets wrong, and pull requests are all welcome. Start with
CONTRIBUTING.md. Found a security problem? Please report it
privately, as SECURITY.md explains, not in a public issue. Everyone
taking part follows the Code of Conduct.
Prior work
- pig-dot-dev/muscle-mem, "a cache for AI
agents to learn and replay complex behaviors". The closest existing idea. Dejo is not a cache:
every step carries a check, so it can tell a changed site from a working one, repair the single
step that moved, and hand a working route to another agent.
- @playwright/mcp, whose accessibility-tree
snapshot approach Dejo's page reading is built on.
License
MIT. See LICENSE.
