What is Stagehand? The AI browser automation SDK

Stagehand is an open-source SDK from Browserbase for automating a web browser with a mix of ordinary code and natural-language instructions. A developer can write page.goto() for a step with a stable selector and act("click the sign-in button") for a step where a language model should find the target.

This article is about the software library, not the theater job. It covers what Stagehand does, where its browser runs, and what that means for a site that receives its traffic.

What Stagehand provides

The Stagehand repository is published under the MIT license. The current documentation describes version 4, with matching SDKs for TypeScript, Python, and Go.

The library has two layers. The first is a set of Playwright-style page methods such as goto, click, type, and locator. The second is three AI primitives:

act performs one action on the page. According to the act documentation, passing an instruction runs model inference to find the target, while passing a previously observed action replays it with no inference. The docs recommend chaining single-step calls rather than writing multi-step instructions.
observe returns candidate actions for the current page, each with a selector, description, and method, as described in the observe documentation. A developer can inspect one and hand it back to act.
extract pulls structured data from a page and validates it against a schema the developer defines, per the extract documentation.

Earlier versions also had an agent() method that looped over these tools and let a model choose each step. The v3 to v4 migration guide says agent() is gone in v4. Browserbase now recommends that a coding assistant write a Stagehand script once, or that developers plug Stagehand into their own tool-calling loop. The introduction describes Stagehand as "the hands" and the developer's agent framework as "the brain."

How the language model fits in

Stagehand does not require one model provider. The models documentation lists OpenAI, Anthropic, and Google as supported providers and also accepts a client-side callback for a custom model. When the browser runs on Browserbase and no model is set, Browserbase's Model Gateway picks a model for each call.

Caching changes how often a model is involved. The caching guide says Browserbase caches act, observe, and extract results on its servers. A repeated call with the same instruction, page content, and options returns without inference, and a cached act replays the recorded selector. This cache only exists for Browserbase-hosted browsers; the same page says local browsers cannot use it.

For a defender, this matters because a mature Stagehand job may call a model rarely or never. Its per-step timing can look like a plain script rather than an agent pausing to think.

Where the browser runs

The browser configuration page documents three options:

launch a cloud browser on Browserbase;
launch a local Chromium browser on the developer's machine;
attach over the Chrome DevTools Protocol (CDP) to a Chromium browser that is already running.

Stagehand drives the browser over CDP and, according to its introduction, has no Playwright or Puppeteer dependency. In v4 its runtime runs inside the browser through an extension. For local launches, the documentation lists the Chrome arguments Stagehand adds by default, including --enable-unsafe-extension-debugging so the SDK can attach to that extension's service worker. Those are launch settings on the client, not headers a website receives.

Stealth, proxies, and CAPTCHAs belong to Browserbase

Stagehand's own docs point to Browserbase for identity and network features. The browser configuration page says the Browserbase environment offers "stealth mode, proxy support, and persistent contexts," and shows proxies, solveCaptchas, and a verified setting passed through browserbase.launch().

Those features are documented by Browserbase, not implemented in the Stagehand library:

Browserbase proxies can route a session through managed residential proxies or a customer's own HTTP proxies.
Browserbase CAPTCHA solving is enabled by default for sessions.
Browserbase Verified sessions use a purpose-built browser with fingerprints that Browserbase says are recognized by its bot protection partners.

A local Stagehand run gets none of these by default. It uses whatever browser, profile, and network the operator provides. The docs also note that authenticated proxies are not yet supported for local browsers.

What a target site can observe

A site does not receive a "Stagehand" label. It sees a Chromium browser, a network path, and a sequence of requests and interactions. That picture changes with the deployment:

On Browserbase: the session carries whatever proxy, CAPTCHA, and identity settings the operator chose. In our September 2026 benchmark, Centinel detected Browserbase. That result covers Browserbase sessions; Stagehand itself was not part of the benchmark.
Locally or over CDP: the traffic comes from the operator's own machine or infrastructure, with their browser build and network. Nothing from the Browserbase result applies to these runs.

In both cases, detection works from evidence rather than the tool name. Check whether the browser's claims, the connection, and the request headers agree. Look at how the session moves through a flow and whether the same task pattern repeats across different IPs or identities. How to detect browser automation describes that evidence model in more detail, and What is Browserbase? covers the hosted side.

Deciding what Stagehand traffic may do

The same SDK can run a test suite, fill a form for a user, or extract data at scale. Detecting it answers one question: is this client automated? Whether it may continue depends on what it is doing.

Set the rule by resource. Automated reads of a public page need a different response from automated logins, checkout attempts, or bulk extraction of listings. Where an agent operator has agreed to identify itself, verify the agent and give it an allow path. For the rest, start by observing which routes the traffic reaches, then apply the least disruptive control that stops the abuse.