ZeroDOM

On this page

Suggest an edit

99.0%

selector resolution accuracy

98.9%

median token savings vs raw HTML

10-30ms

deterministic parse, no model call

Choose your path

Pick the one that matches what you're here to do.

[

I want to try it

Parse a page and read the graph in three lines.

Quickstart](https://zerodom.vexralabs.com/docs/quickstart)[

I want to build an agent

Walkthrough](https://zerodom.vexralabs.com/docs/walkthrough)[

I want to integrate it

Wire ZeroDOM into Claude Desktop, Cursor, or your own loop.

MCP setup](https://zerodom.vexralabs.com/docs/mcp-setup)[

I want to test authorization

Two identities, replay, compare: broken access control and IDOR.

Authorization testing](https://zerodom.vexralabs.com/docs/authorization-testing)

Two workflows, one graph

The parse is identical either way: a flat list of every element the page can act on. What you pipe it into is the difference.

AI agent & automation engineers

Feed a token-dense graph into your LLM loop as compact text or a JSONL node stream. Numbered handles stay stable across turns; the selector is resolved on your side, never in context.

• 98.9% fewer tokens than raw HTML
• JSONL straight into the loop: zerodom inspect --pipe
• MCP server for Claude / Cursor, no headless bot walls

Security operators & bug-bounty hunters

Drive your real, logged-in Chrome to reach authenticated surfaces, then test them: compare two identities to surface broken access control and cross-tenant IDOR. You confirm the bug.

• Cross-identity authz: zerodom compare / zerodom sweep
• Real session via the relay + extension (sidesteps bot walls)
• Deterministic client-side rules: zerodom scan

From the terminal

Unix-native: a URL in, structured lines out, ready for jq or an agent loop. The full flag list is in the CLI reference.

zerodom inspect https://example.com          # token-dense interaction graph + savings report
zerodom inspect --pipe https://example.com   # flat node array as JSONL, into an agent loop
cat targets.txt | zerodom scan -             # match authorized targets against surfaces.yaml
zerodom compare URL --as a=a.json --as b=b.json   # two identities, diffed — the IDOR primitive

How it works

The selector never leaves your process. A model only ever sees a node id like [03]; the CSS path that addresses the element lives in selector_map(), on your side, and is resolved right before the click. See Architecture for the full system design.

1

Live page

a Playwright Page, or HTML you already have

2

ZeroDOMParser

one DFS pass: prune, collect, label

3

InteractionGraph

compact text or JSON, sent to the model

4

Model picks a node

e.g. click [03], never a selector

5

selector_map()[node]

resolved on your side, not the model's

6

Act

click/fill via Playwright, then re-read

Reference

• Rule packs Write a deterministic detection in five lines of Nuclei-style YAML.
• Clearance ladder How ZeroDOM clears a challenge wall, zero-egress by default.
• Architecture System overview, data flow, parser internals, and token economics.
• Tool reference All 35 MCP tools, with signatures and the token cost of each call.
• Bug bounty recon Stealth Chrome pipe, surface scanning, and the isolation sandbox.
• Seeing the graph Screenshots, HTML reports, and the on-page driving bar.
• Limitations Every boundary, stated plainly: what ZeroDOM deliberately won't do.