OpenZero Tab Pilot

Connection & safety settings

The API key stays in Brave extension-local storage and is sent only to the exact OpenZero origin you approve.

OpenZero connection

API origin

Plain HTTP is accepted only on loopback. For a remote server, use HTTPS or an SSH tunnel to 127.0.0.1.

OpenZero API key Clear the saved API key Default model

Tab Pilot defaults to openzerogemma:latest. The model must appear in OpenZero's authenticated /v1/models response.

OpenZero Z-Spark

Not tested yet.

Run limits

Maximum actions per run

Model timeout in seconds

A step limit prevents a bad plan from looping forever. The extension re-inspects the page before every model-planned action.

Action permissions

Allow same-site navigation; every new site pauses for consent Allow clicks on inspected elements Allow typing into ordinary fields Require a one-time human approval for consequential or personal-data actions

Password, payment, secret/token, file-upload, CAPTCHA, arbitrary JavaScript, raw CSS selector, and browser-internal page control remain blocked regardless of these settings.