Burrowbox Blog
← All posts

AgentCore Browser gives agents a browser per session. Keep the whole computer with Strands Agents

· The Burrowbox team · 8 min read

#What Amazon Bedrock AgentCore Browser does

Amazon Bedrock AgentCore Browser is a managed cloud browser for agents, and it works by the session. You start a session, your agent drives it, and the session ends when you stop it or when it times out. The default timeout is 15 minutes, and you can raise it to 8 hours when you start the session. A single browser tool can run up to 500 sessions at once. (AWS docs, session management)

Each session runs in a dedicated microVM with its own CPU, memory and filesystem. When the session ends, the microVM is terminated and its memory is sanitized. A person can watch a session through its live view and interact with it, and sessions can be recorded to an S3 bucket, network traffic and console logs included.

Since February 2026 it also has browser profiles. A profile stores cookies and local storage. You log in during one session, save that session to the profile, and the next session that starts with the profile is already signed in. Profiles are saved only when you call the save operation, a save overwrites what was there, and websites' own cookie expiry still applies. (AWS docs, browser profiles) The same release added routing through your own proxy servers and loading Chrome extensions. (AWS ML blog)

Amazon Nova Act can drive it: the quickstart opens an AgentCore session and hands its CDP endpoint to Nova Act. (AWS docs, Nova Act quickstart)

With a profile, an agent doesn't have to log in again on every run. Burrowbox isn't involved with AWS.

#The pattern: a browser per session, or a computer that stays

AgentCore Browser gives you a fresh, isolated browser every time and lets you carry the login forward in a profile. That fits work that lives entirely in web pages.

Some agents need more than the browser. They download a file and open it in a desktop app, keep a working folder from one run to the next, or need the same exit country every time. For those, the other shape is a whole computer that stops and starts as it was. The sandbox-or-computer explainer covers the general trade-off. Here is how the two compare on what survives between runs:

AgentCore Browser + profile Burrowbox machine, stop and start
Cookies and local storage Restored from the profile, if you saved it Kept: every stop snapshots the filesystem, browser cookies included
When state is saved When you call save On every stop, plus a save point every 30 minutes while running
Files on disk Gone when the session's microVM is terminated Kept
Desktop apps Browser only Installed apps are kept
Open tabs and windows Not described in the profile guide, which covers cookies and local storage Recorded on stop and reopened on start
Running processes End with the session Memory isn't kept, so programs are relaunched
Egress Your own proxy server A VPN location by country, run by Burrowbox

The Burrowbox column comes from Machines and VPN locations.

#Build it with Strands Agents and a Burrowbox machine

A Burrowbox machine is a Linux desktop with its own MCP endpoint. Its tools cover the browser (browser_navigate, browser_snapshot, browser_login), the desktop (screenshot, get_app_state, click), apps (apps_install, apps_launch), files and shell_run. The full list is in MCP. Strands Agents connects to it as a Streamable HTTP MCP server.

#1. Create the machine

Use the full browser (Chromium), which also keeps sign-ins through live updates, and give it a VPN location so it always browses from the same country.

curl -X POST https://burrowbox.dev/api/machines \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"name": "invoices-agent", "size": "small", "browser": "full", "vpn": {"type": "proxy", "country": "de"}}'
# → { "id": "…", "mcpUrl": "https://burrowbox.dev/api/machines/…/mcp", "mcpToken": "tmm_…" }

#2. Put the login in the vault

The agent signs in with browser_login, which fills the form from the machine's vault and handles TOTP codes. The password never goes into the prompt. The 2FA vault tutorial goes through this step in detail.

curl -X PUT https://burrowbox.dev/api/machines/$MACHINE_ID/vault/supplier \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"url": "https://portal.example.com/login", "username": "ops@acme.com", "password": "…", "totpSecret": "…"}'

#3. Run a Strands agent against the machine (Python)

The MCP connection follows the Strands MCP transports guide. Amazon Bedrock is Strands' default model provider, so this needs your usual AWS credentials and no model object (Strands quickstart).

# pip install strands-agents mcp requests
import os
import requests
from mcp.client.streamable_http import streamablehttp_client
from strands import Agent
from strands.tools.mcp import MCPClient

BB = "https://burrowbox.dev"
auth = {"Authorization": f"Bearer {os.environ['BURROWBOX_KEY']}"}
machine_id = os.environ["MACHINE_ID"]

machine = requests.get(f"{BB}/api/machines/{machine_id}", headers=auth).json()
if machine["status"] == "stopped":
    requests.post(f"{BB}/api/machines/{machine_id}/start", headers=auth).raise_for_status()

burrowbox = MCPClient(lambda: streamablehttp_client(
    url=machine["mcpUrl"],
    headers={"Authorization": f"Bearer {machine['mcpToken']}"},
))

try:
    with burrowbox:
        agent = Agent(tools=burrowbox.list_tools_sync())
        agent(
            "Open https://portal.example.com/invoices. If it asks you to sign in, use browser_login. "
            "Read this month's invoice table with browser_snapshot and save it to ~/reports/invoices.csv with file_write. "
            "Open the CSV in LibreOffice Calc with apps_launch; if apps_list can't find it, install it first with "
            "apps_install (kind apt, packages ['libreoffice-calc']). Check the totals with get_app_state, then reply with the total due."
        )
finally:
    # State is kept: the login, ~/reports and LibreOffice are all there next time.
    requests.post(f"{BB}/api/machines/{machine_id}/stop", headers=auth)

The machine token only reaches this one machine. On the next run the browser is still signed in, LibreOffice is already installed and last month's CSV is still in ~/reports, so the agent starts where it left off. There's no separate save step: stopping the machine saves it.

To run it on a timer without your own scheduler, a Burrowbox scheduled job or webhook can wake the machine and, with stopAfter: true, stop it again after the run.

#Pin the egress country

The machine above browses from Germany, so prices, languages and content match what a local visitor sees. Burrowbox runs the network, so you don't need a proxy account, and each machine keeps the same exit IP for as long as the network allows. To change the country on a running machine, without a restart:

curl -X PUT https://burrowbox.dev/api/machines/$MACHINE_ID/vpn \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"vpn": {"country": "fr"}}'

The agent can check where it is with the network_info tool, and your server can check with GET /api/machines/{id}/vpn. AgentCore's proxy support routes traffic through a proxy server you operate, while here the location is a field on the machine.

#What it costs

A small machine (1 vCPU, 6 GB) costs $0.11 an hour while running and $0.001 an hour ($0.72 per 30 days) while stopped. The proxy VPN adds $0.03 an hour while running plus $10 per GB of traffic. Machine rates are in Billing, and VPN prices are in the VPN locations docs.

#When AgentCore Browser is the better fit

If your agents only browse, your stack is already on AWS, and you want IAM-governed access, hundreds of parallel isolated sessions and recordings in S3, AgentCore Browser covers that directly. Choose a persistent machine when the agent's work spans the browser, the file system and desktop apps, or when it should come back tomorrow to exactly the same computer. For a browsing agent that runs on a schedule with a signed-in cloud browser, see the Comet post.

Key takeaways:

  • AgentCore Browser sessions are short-lived and isolated by design (15 minutes by default, 8 hours at most). Profiles carry cookies and local storage forward when you save them.
  • A Burrowbox machine keeps its files, installed apps, browser logins and open tabs across every stop and start, without a save step.
  • Strands Agents reaches the machine's tools with MCPClient and streamablehttp_client, authenticated with the machine's mcpToken.

Create an account to try it.

#FAQ

#How long does an AgentCore Browser session last?

15 minutes by default. You can set the timeout when you start the session, up to 8 hours, and the session ends automatically when the timeout is reached. (AWS docs)

#Do AgentCore browser profiles keep you logged in?

Yes, if you save the session to the profile after logging in. A new session started with that profile gets the saved cookies and local storage. Changes only reach sessions started after the save, and cookies still expire on the website's schedule. (AWS docs)

#Can Strands Agents use a remote MCP server?

Yes. Wrap streamablehttp_client(url=..., headers=...) in an MCPClient, open it with with, and pass list_tools_sync() to the Agent. (Strands docs)

#What does a stopped Burrowbox machine keep?

Its entire filesystem: files, installed apps, the vault and browser cookies, including session cookies. Open windows and tabs reopen on the next start. Memory isn't kept, so running programs are relaunched.

#Sources