{"commands":[{"command":"nephew init","description":"Connect your own provider accounts."},{"command":"nephew capture","description":"Sign in once, in your own browser; the session is sealed into an encrypted bundle you hold."},{"command":"nephew run <job> --provider modal|steel|browseruse|browserbase","description":"Run a job as the carried identity. The fingerprint gate must accept before any state is released."},{"command":"nephew run <job> --provider steel|browseruse|browserbase --handoff","description":"If challenged, hold the live session for a streamed human handoff instead of closing it."},{"command":"nephew revoke","description":"Destroy a bundle and its key material; leaves an Ed25519-signed deletion receipt."},{"command":"nephew receipt verify <file>","description":"Verify a signed run receipt: PASS, or FAIL naming the field that changed."},{"command":"nephew mcp","description":"Run the MCP server exposing the profile_run tool."}],"description":"Nephew is the profile layer for the sandbox providers you already use. It carries one logged-in browser identity — cookies, session state, a coherent fingerprint, and a pinned egress IP — into Modal, Steel, Browser Use, and Browserbase. It is not another sandbox and does not replace them: jobs still run on the user's provider, under the user's account. There is no Nephew account to create, no Nephew cloud in the middle, and no Nephew server ever holds a profile.","handoff":{"deadline":"Absolute, computed on a monotonic clock at start; late arrival, reloads, reconnects, and wall-clock changes cannot extend it.","defaultTtlSeconds":360,"eventRecord":"Counts and identifiers only: frames relayed, inputs forwarded, outcome. No frames, no keystrokes, no page content, no token.","onEndOrExpire":"Nothing is captured.","onResume":"The live state is captured and sealed into the owner bundle.","providers":["steel","browseruse","browserbase"],"singleController":true,"singleSession":true,"surface":"Loopback-only page (127.0.0.1) streaming the live session from CDP screencast frames, with mouse and keyboard input forwarded back.","trigger":"LOGIN_REQUIRED pause","unavailableOn":["modal"],"unavailableReason":"Modal's browser runs inside the sandbox and exposes no host-side CDP session to lend; a Modal run that needs a login returns the plain LOGIN_REQUIRED pause.","who":"The profile bundle's designated human only; every route requires a per-handoff token bound to that human."},"howItWorks":["Capture once: the session is sealed into an encrypted bundle the owner holds — profile state, fingerprint recipe, pinned proxy reference. Keys never leave the owner's machine.","Run anywhere: the sandbox browser is measured against the recipe; the fingerprint gate must accept before any state is released — on mismatch, the run refuses.","Challenged: the run pauses with LOGIN_REQUIRED and, on Steel, Browser Use, and Browserbase, can hand the live session to the designated human; resuming captures the fixed session back into the same bundle.","Capture back: when the job ends, the live session is sealed back into the same bundle. One identity, no forks."],"install":{"checksum":"Download verified against the published SHA256SUMS before install; a mismatch aborts.","command":"curl -fsSL https://nephew.ai/install | sh","requires":["Node.js 22 or newer"],"sudo":false,"writes":["~/.local/lib/nephew","~/.local/bin/nephew"]},"limits":["A site can still challenge a run. When it does, the run pauses with LOGIN_REQUIRED; the live handoff is the recovery on Steel, Browser Use, and Browserbase, and on Modal the recovery is still re-capture and retry.","Browserbase sessions: the 5-minute timeout in a project's settings is the default when no timeout is requested; Nephew requests an explicit 1-hour window — measured granted in full, including a probe at the 21,600-second API maximum.","One dedicated IP per identity, per-profile by design.","A handoff is one designated human, one controller, on a loopback page — and it ends at its deadline whether the login is fixed or not.","No 'works on every site' claims. Every run is measured the same way and writes its own metrics record."],"llmsTxt":"https://nephew.ai/llms.txt","measuredProof":["Same profile, owner's machine vs a Modal sandbox: identical fingerprints — all 10 measured elements, canvas included — with the pinned font pack in both environments.","Pinned egress, verified live: a Modal run egressed from the profile's own dedicated IP, exactly as pinned in its recipe; the gate checked the egress before releasing state and accepted, and the session was restored. The address itself is carried in the run's own metrics record.","Baseline restores: ~6.4 s on Steel, ~7.8 s on Browser Use, ~5.7 s on Browserbase; full Modal runs 10–27 s in-session.","0 login prompts, 0 MFA prompts across the Steel, Browser Use, Modal, and Browserbase proof runs."],"name":"nephew","pillars":["Portable","Continuous","Yours"],"pricing":{"meter":"Profiles (identities you own) plus run-hours (time an agent spends logged in as you). No per-seat fees.","tiers":[{"concurrency":1,"includedRunHours":"1 hosted run-hour trial","mode":"BYO","name":"Free","priceUsdPerMonth":0,"profiles":2},{"concurrency":3,"extraProfileUsdPerMonth":3,"includedRunHours":"Unlimited — the customer pays their providers directly","mode":"Customer's own Modal / Steel / Browser Use / Browserbase / Bright Data accounts","name":"BYO","priceUsdPerMonth":19,"profiles":10},{"concurrency":3,"includedRunHours":30,"mode":"Hosted, each profile with its own dedicated ISP IP","name":"Hosted","overageUsdPerRunHour":0.6,"priceUsdPerMonth":59,"profiles":5},{"concurrency":10,"includedRunHours":200,"mode":"Hosted, profiles with dedicated ISP IPs","name":"Hosted Team","notes":"Profile sharing, priority support","overageUsdPerRunHour":0.5,"priceUsdPerMonth":199,"profiles":20},{"concurrency":"custom","includedRunHours":"custom","mode":"Own-stack / BYOC deploy","name":"Enterprise","notes":"SSO, custom regions, SLA","priceUsdPerMonth":"custom","profiles":"unlimited"}]},"providers":{"notYet":[],"note":"The same bundle and the same fingerprint gate run on all four supported providers. Provider accounts and keys are the user's own; Nephew never stores them. On Browserbase the bundle is the only state a session sees — Nephew never uses Browserbase Contexts, and sessions are created with the API key alone (no project id).","supported":["modal","steel","browseruse","browserbase"]},"receipts":{"deletionReceipt":"nephew revoke leaves an Ed25519-signed deletion receipt, independently verifiable.","runReceipt":{"fields":["profileId","runId","provider","environment (fingerprint hashes)","egressIp (observed)","startedAt","endedAt","outcome","humanAttentionMinutes","handoffUsed"],"signedWith":"The owner's Ed25519 receipt-signing key — the same key that signs the deletion receipt.","storage":"~/.nephew/receipts/ (mode 0600)","verify":"nephew receipt verify <file> — verifies against the owner's public key; PASS, or FAIL naming the differing field."}},"site":"https://nephew.ai","surfaces":{"cli":"nephew","mcp":{"command":"nephew mcp","handoffHandle":"On Steel, Browser Use, and Browserbase, the LOGIN_REQUIRED pause result carries the live handoff handle.","pauseResult":"LOGIN_REQUIRED","tools":["profile_run"]},"python":{"name":"with_profile","note":"Modal runs through the CLI.","package":"nephew (Python)","providers":["steel","browseruse","browserbase"]},"typescriptHelper":{"name":"withProfile","note":"Modal runs through the CLI.","providers":["steel","browseruse","browserbase"]}},"tagline":"Your logged-in identity, in any agent sandbox."}