Give OpenClaw a disposable browser.

1. 01

   Add the Legba MCP server.

   Point OpenClaw at the Legba MCP server. The agent reaches the browser as a tool, not as a local install. No Chromium on your machine. No driver to babysit.

   What this does: registers Legba as a tool the agent can call.

   terminal · add-mcpbash

   # add Legba as an MCP server for the agent
   npx @legba/mcp install --client openclaw
   
   # or point at the hosted endpoint directly
   export LEGBA_API_KEY="sk_live_..."

2. 02

   Scope the session.

   Declare what the browser is allowed to reach. Pick a geography, set a TTL, and burn on close. The agent sees only what you scope, never your cookies or credentials.

   What this does: bounds the blast radius before the agent runs.

   openclaw.config.jsonjson

   {
     "tools": {
       "legba": {
         "command": "npx",
         "args": ["@legba/mcp"],
         "env": { "LEGBA_API_KEY": "${LEGBA_API_KEY}" },
         "session": {
           "region": "us-east",
           "ttlSeconds": 600,
           "burnOnClose": true
         }
       }
     }
   }

3. 03

   Run the agent.

   Start OpenClaw with a task. The agent spawns a fresh browser, does the work, and reports back. A prompt injection has nowhere to go. The session is the boundary.

   What this does: runs the agent against a real browser it cannot escape.

   terminal · runbash

   openclaw run \
     --config openclaw.config.json \
     --task "log in and export the invoice as PDF"
   
   # the agent calls legba.spawn(), drives the page,
   # then the session is destroyed when the task ends

4. 04

   Burn it on close.

   The TTL hits or the task ends. Cookies, storage, tokens, and fingerprint are gone. Nothing escapes because nothing is left. Run the next task on a clean session.

   What this does: leaves no trail after the agent finishes.

   terminal · session lifecycletext

   > session.spawn --burn-on-close
   status: spawned
   browser: chromium / real fingerprint
   > task complete
   > session.destroy
   status: gone

The agent calls the browser through the MCP server. For every session param and the full lifecycle, read the docs.