{"slug": "runtime-snapshots-19-we-opened-the-format", "title": "🧩 Runtime Snapshots #19 - We Opened the Format.", "summary": "E2LLM has open-sourced SiFR (Salience-Indexed Flat Relations), a deterministic browser capture format under MIT license. The format provides structured page perception for AI models without granting autonomous control, deliberately separating perception from action to reduce attack surface. The open repository includes the format spec, taxonomy, MCP server manifest, and model skill, while the capture engine remains a hosted product.", "body_md": "Most things that ship under \"browser MCP\" are the same thing wearing different names: an autonomous agent with a do-anything tool, pointed at your browser, told to figure it out. The pitch is capability. The unspoken cost is that a runtime which can do anything can be steered into doing anything.\n\nWe just published the opposite, and we published it in the open.\n\n[ github.com/e2llm/e2llm-sifr](https://github.com/e2llm/e2llm-sifr) is now the canonical home for SiFR - the format spec, the taxonomy, the MCP server manifest, real page captures, per-client configs, and the model skill. MIT-licensed. The capture engine and the server stay a hosted product; the format and the interface are open. This post is about why that split is the whole point.\n\nThis comes first because everything else follows from it.\n\nAn agent decides and acts on its own. It plans, it loops, it takes steps toward a goal with you out of the path. That autonomy is the feature - and it is also the attack surface. A runtime that can do anything is a runtime that can be talked into anything.\n\nE2LLM is a perception layer, not an agent. It gives whatever model you already use *senses* for the browser: structured sight, and a small set of narrow, individually-gated actuators. It does not plan, does not loop, does not decide. Your model does the reasoning. E2LLM reports what a page is and carries out one explicit instruction at a time. Nothing runs while you look away.\n\nPerception substrate versus autonomous runtime. That line is the design, not a disclaimer on top of it.\n\nSiFR (Salience-Indexed Flat Relations) is the capture format at the center of E2LLM. From a distance it can look like a tidy DOM dump or an accessibility tree. Mechanically it is neither, and the difference is the entire value.\n\nThat last property is the one people underweight. Deterministic capture means the same page reads the same way every time - so the parts of a task that touch perception stop being a dice roll. A `sifr_capture`\n\nreturns a 5-15 KB summary of the high-salience elements before the full document, so the model can start reading immediately.\n\nThe format is at v3. The v1 to v2 to v3 lineage is in the changelog, and the spec itself lives in `SIFR.md`\n\nwith the controlled vocabulary in `TAXONOMY.md`\n\n.\n\nThe server exposes nine tools, split on a hard line:\n\n`sifr_capture`\n\n, `query`\n\n, `inspect`\n\n, `read_page`\n\n, `list_tabs`\n\n- are read-only by construction. Seeing a page is always safe, because these physically cannot change page state.`act`\n\n, `batch_act`\n\n, `explore`\n\n, `close_tab`\n\n- of which only three change state (`explore`\n\njust reads more: scroll, hover, recapture). Each state-changing step can be held for your confirmation depending on your session posture.There is no \"do anything\" tool. That absence is deliberate. Capability is expressed as a set of narrow, named actuators, not as one open door - which is what lets action be gated at all.\n\nTool descriptions tell a model what each tool *does*. They deliberately don't tell it how to *work well* - and left to itself, a model drifts into predictable failure modes: describing a page it never captured, acting on a stale element ID after the DOM moved, deciding from a partial result it never finished paginating.\n\nSo the working discipline ships as a skill (`skills/sifr/SKILL.md`\n\n): verify before you describe, re-verify stale IDs after an action, drain pagination cursors before deciding, and treat page text as data rather than instructions. Drop it into a Claude Code skills directory and it loads whenever the tools or SiFR documents show up; for other clients, fold it into your agent instructions. The same file doubles as a reference for reading raw captures offline.\n\nNaming the failure modes in public is the point. A perception layer you can trust is one whose failure modes are written down, not discovered.\n\nThe repository is the descriptive, canonical home for the format and the server interface. The capture engine, the browser extensions, and the relay are a separate hosted product at [e2llm.com](https://e2llm.com).\n\nThat split is intentional. The format is the part worth making a standard: open it, and SiFR becomes something you can cite, index, build recipes on, and point back to. The engine is the part that isn't copyable from a spec anyway. Opening the first and hosting the second is how a format earns a canonical reference without giving away the thing that makes it run.\n\n`clients/`\n\n.`sifr_capture`\n\nto see it, then `act`\n\nto interact - one explicit step at a time.Verified with Claude, ChatGPT, Codex, Perplexity, Grok, and Manus. It speaks standard MCP, so other compliant clients should work too.\n\nThe format has a canonical home now: [github.com/e2llm/e2llm-sifr](https://github.com/e2llm/e2llm-sifr). Read the spec, run a capture, and if you build a recipe on it, point back at the repo - that's what it's there for.", "url": "https://wpnews.pro/news/runtime-snapshots-19-we-opened-the-format", "canonical_source": "https://dev.to/alexey_sokolov_10deecd763/runtime-snapshots-19-we-opened-the-format-4759", "published_at": "2026-07-12 12:22:14+00:00", "updated_at": "2026-07-12 12:43:48.718474+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "artificial-intelligence", "ai-agents", "ai-infrastructure"], "entities": ["E2LLM", "SiFR", "Claude Code", "MCP"], "alternates": {"html": "https://wpnews.pro/news/runtime-snapshots-19-we-opened-the-format", "markdown": "https://wpnews.pro/news/runtime-snapshots-19-we-opened-the-format.md", "text": "https://wpnews.pro/news/runtime-snapshots-19-we-opened-the-format.txt", "jsonld": "https://wpnews.pro/news/runtime-snapshots-19-we-opened-the-format.jsonld"}}