Agents don’t browse. Why the call layer had to exist.

Ask an agent to swap a token today and watch what it actually does. It opens a browser. It waits for a single-page app to hydrate. It hunts for a button whose class name changed last Tuesday. It hits a wallet pop-up it can’t read, a cookie banner it shouldn’t accept, and a confirmation screen rendered as a canvas. Somewhere in there, it is supposed to understand that it is about to spend your money.

This is the part of agent infrastructure nobody wants to look at. The models got good. The tooling around them did not follow, because the surfaces they were pointed at were never designed to be read by anything except a person.

The interface tax

A browser is a rendering target. It exists to turn structured data into pixels for eyes. Asking an agent to drive one means asking it to reverse that transformation on every single step — pixels back into meaning, then meaning back into an action, with no guarantee the meaning survived the round trip. ¹ Vision models have closed much of this gap, but the cost never goes to zero: every screenshot is tokens spent re-deriving something the service already knew.

Every team building on agents pays this tax in the same three ways:

• Brittleness. Selectors are not an API. A layout change ships on Tuesday and your integration breaks on Wednesday, silently, with no version to pin.
• Ambiguity. “Confirm” on one protocol means “sign”, on another it means “approve spending forever”. The screen doesn’t distinguish them; a typed contract would.
• All-or-nothing trust. To let an agent transact at all, you hand it a private key. There is no smaller unit of permission to give.

The future of frontend is your model. There’s no reason to render a page for something that was never going to look at it. Waypoint, founding note

What a call actually looks like

Strip the interface away and what remains is small. A service declares what it can do and what each function needs. An agent calls it. A typed result comes back. The same input produces the same output, every time.

// agent session — scoped, budgeted
$ waypoint session start --budget 200
✓ key issued · scope: swap, lend, stake

agent > wp.call("helix.swap", {
  in:  "USDC",
  out: "ETH",
  amount: 1200
})
// 200 · 84 ms · tx 0x8f3…c21

No page was rendered. No selector was guessed. The agent didn’t need to know what Helix’s interface looks like, because it never saw one.

Scope is the harder half

Removing the browser is the obvious part. The part that actually decides whether anyone lets an agent near their funds is what replaces the private key.

A Waypoint session is a scoped key your agent holds. One key can carry multiple budgets, and each budget has a spending cap, a set of allowed functions, and an expiry — all enforced on-chain rather than promised in an interface. ² Enforcement lives in the smart account itself, so a compromised agent still cannot exceed a cap or call a function that was never switched on.

What this makes possible

Once calls are typed and permissions are narrow, the interesting behaviour stops being “can the agent click the button” and starts being what you’d actually want from it:

• Route a trade across every venue at once, because pricing is a function call and not a page.
• Watch a position overnight and act inside rules you set while you were asleep.
• Hand the same key to a different model tomorrow without re-approving anything.

Where this goes

We think the browser is a transitional surface for agents, the way the command line was a transitional surface for people — useful, universal, and eventually not where the work happens. What replaces it isn’t a better scraper. It’s a layer where every service is already legible to the thing calling it.

That layer is what we’re building. If you run a protocol, publishing to the directory takes a single schema file and most teams go live the same day. If you build agents, early access is open now.