CloakBrowser Stealth Browser
Stealth Chromium with source-level C++ fingerprint patches that passes bot detection tests, a drop-in Playwright replacement.
Evidence shows: MIT license, pinned dependencies, Ed25519 signature verification for binary downloads, but no explicit least-privilege principle, missing user confirmation, limited data flow transparency, unclear sensitive data handling (e.g., proxy credentials), partial disclosure of external effects (e.g., network calls), rollback exists but limited, source attribution only via GitHub repo and author info, publisher identity unverified. Deductions: missing user confirmation, insufficient data flow transparency, unclear sensitive data handling, incomplete external effects disclosure, imperfect rollback, unverified source attribution.
Evidence shows: good internal consistency in code and tests, clear dependency versions, but failure messages are limited in detail. Deductions: failure messages may not be detailed enough, dependency availability not fully verified.
Evidence shows: targets developers, provides multiple use scenarios, clear capability boundaries, precise triggers, good environment fit. Deductions: some scenarios (e.g., Docker) not fully detailed.
Evidence shows: clear information architecture, detailed install notes, stable naming, rich examples and FAQ, partial known limitations, clear license, versioning and changelog present, maintenance responsibility clear. Deductions: incomplete known limitations, maintenance responsibility not fully clear.
Evidence shows: high output usability, clear marginal value, but cost-benefit not fully explained. Deductions: insufficient cost-benefit analysis.
Evidence shows: some claims supported by tests, but insufficient cross-source corroboration, unclear separation of facts and inferences. Deductions: insufficient cross-source corroboration, unclear fact-inference separation.
- The project claims to bypass all bot detection, but no reproducible test results are provided, and tests may be environment-specific.
- Binary downloads and license validation rely on external services, posing supply chain risks.
- Handling of sensitive information like proxy credentials is not clearly documented, potentially leading to logging or leakage.
- No user confirmation mechanism is provided, which may lead to automatic execution of high-risk operations.
What does this agent do, and when should you use it?
CloakBrowser is a modified Chromium binary with C++ source-level patches to make fingerprints indistinguishable from a real browser. It provides Python and JavaScript wrappers with APIs fully compatible with Playwright and Puppeteer. The browser auto-generates random fingerprints by default and includes 71 patches (version 150) covering Canvas, WebGL, audio, GPU, network timing, and more, even supporting human-like behavior simulation. It passes tests against 30+ detection sites, including Cloudflare Turnstile and FingerprintJS, and offers free and Pro tiers. Installation is simple via pip or npm, with Docker support and integrations for multiple frameworks.
CloakBrowser provides functions like launch(), launch_async(), launch_context(), and launch_persistent_context() to start a browser. It automatically downloads and verifies pre-compiled Chromium binaries, supports proxies (HTTP/SOCKS5), GeoIP auto timezone/locale, humanized mouse/keyboard operations (humanize=True), and persistent profiles. It manages fingerprints via command-line arguments like --fingerprint and offers CLI commands (cloakbrowser login, install, etc.) and a Docker image (cloakhq/cloakbrowser) for quick testing.
- Web scrapers needing to bypass Cloudflare Turnstile or reCAPTCHA.
- QA engineers automating tests that require realistic user behavior.
- Social media automation tools that need to avoid account linking.
- Users accessing geo-restricted content using proxy and GeoIP features.
- AI agent developers needing to run stealth browser instances at scale.
- Developers wanting seamless integration with Playwright/Puppeteer to reduce migration costs.
What are this agent's strengths and limitations?
- Source-level patches provide stealth harder to detect than JS injection or config patches.
- Fully compatible with Playwright/Puppeteer API for easy migration.
- Continuously updated to keep up with anti-bot evolution.
- Multi-language support (Python, JS, C#) and Docker deployment.
- Free tier available to try the latest binary quickly.
- Free tier limits to one concurrent session, and older binaries become less effective over time.
- Advanced features (e.g., reCAPTCHA 0.9 score) require a paid Pro subscription.
- Large binary (~200MB) and first download takes time.
- On Linux, may require additional Windows fonts to pass certain detections (e.g., FingerprintJS).
- No built-in proxy rotation or CAPTCHA solving; you must bring your own.
How do you install or deploy this agent?
Python: pip install cloakbrowser; JavaScript: npm install cloakbrowser playwright-core (or puppeteer-core); .NET: dotnet add package CloakBrowser. The binary (~200MB) auto-downloads on first run. Optional GeoIP support: pip install 'cloakbrowser[geoip]'.
How do you use this agent?
Python example:
from cloakbrowser import launch
browser = launch()
page = browser.new_page()
page.goto("https://example.com")
browser.close()JavaScript example:
import { launch } from 'cloakbrowser';
const browser = await launch();
const page = await browser.newPage();
await page.goto('https://example.com');
await browser.close();Docker quick test: docker run --rm cloakhq/cloakbrowser cloaktest. See README for options like proxy, humanize, fingerprint seeds, and more.
FAQ
What's the difference between free and Pro?
How do I set up a proxy?
proxy="http://user:pass@host:port" or proxy="socks5://..." to launch(). You can also use geoip=True to automatically adjust timezone and locale to match the proxy IP.Why am I still blocked on some sites?
geoip=True, headless=False, and humanize=True. On Linux, installing necessary fonts (like Noto Color Emoji and Windows fonts) may help pass strict detections.Does it support persistent sessions?
launch_persistent_context() to save cookies and localStorage, avoiding incognito detection.