CloakBrowser

2. Basic Project Information

3. What does it do?

The core capability of CloakBrowser is to provide an automated browser that is closer to the real Chrome behavior, so that browser tasks that were originally based on Playwright, Puppeteer, Selenium, or AI agents reduce the probability of being misjudged by automated detection.

It mainly does several things:

1. Source-level browser fingerprint correction

CloakBrowser officials stressed that it has more than 71 C source code level Chromium patches, covering Canvas, WebGL, WebGPU, Audio, fonts, GPU, screen, language, time zone, User-Agent Client Hints, WebRTC, storage quota, media devices, automation signals, etc.

This is different from the common "playwright-stealth" and "puppeteer-extra-plugin-stealth" ideas. The latter usually injects JS or changes startup parameters when the page is loaded, which is prone to inconsistency of "some APIs look like real people while others expose automation. The selling point of CloakBrowser is to put consistency as far as possible at the browser binary level.

1. Keep Playwright / Puppeteer usage habits

Developers don't need to learn a new browser SDK. In the official example, the migration cost is basically to replace import:

'''python

from cloakbrowser import launch

browser = launch()

page = browser.new_page()

page.goto("https://example.com")

browser.close()

'''

The JavaScript is similar:

javascript

import { launch } from "cloakbrowser ";

const browser = await launch();

const page = await browser.newPage();

await page.goto("https://example.com");

await browser.close();

'''

1. Behavioral layer humanize

'humanize = True' allows mouse movement, keyboard input, scrolling, etc. to behave more like a real user, including curved mouse trajectories, input intervals, pauses, and scrolling rhythms.

This is suitable for scenarios such as real user journey testing, synthetic monitoring, and AI Agent operation of web pages. Note, however, that it is not a captcha recognition service and should not be used to circumvent the rules of a website that customers do not have access.

1. Proxy, geographic location and persistence profile

It supports HTTP / SOCKS5 proxy, 'geoip = True' auto-matching timezone / locale / WebRTC IP based on egress IP, persistent browser profile, browser extension path, version pinning/rollback, etc.

These capabilities are more productive: you can do stable sessions, you can also do environmental conformance tests, and you can put existing Playwright scripts into a Docker/CI/server environment to run.

1. Detection Site Verification and Diagnostic Tool

The project README and the official website show the test results of reCAPTCHA v3, Cloudflare Turnstile, FingerprintJS, BrowserScan, deviceandbrowserinfo and other test points. Note: These are the official test results of the project and are not equal to independent third-party evaluation.

4. What is it not?

This part is very important in pre-sales communication, because customers may directly understand it as an "anti-wind control tool".

CloakBrowser not:

-Not CAPTCHA solver, not responsible for identifying verification codes or calling coding platforms.

-Not an agent pool, does not provide residential agents, IP rotation, account system.

-Not a universal anti-crawling tool, website wind control will still combine factors such as account number, IP, behavior, business context, equipment history, etc.

-It is not a compliance waiver tool and cannot bypass target website ToS, robots, authorization boundaries, privacy and data compliance requirements.

-Not a fully open source browser. The wrapper is MIT, and the core browser binary is a proprietary binary distributed CloakHQ, with separate license and Pro subscription terms.

A more accurate expression would be:

It is an automated browser runtime closer to real Chrome, used to reduce the probability of legitimate automated processes being accidentally injured by browser fingerprints.

5. Applicable Scenario

5.1 Enterprise Web Automation QA

Many enterprise sites will be connected to Cloudflare, Akamai, DataDome, FingerprintJS or self-developed wind control. When ordinary Playwright test scripts run in CI, they may be blocked due to Headless Chrome, CDP, navigator.webdriver, font/GPU/screen inconsistencies, etc.

CloakBrowser can be run as a more realistic browser when used in:

-Automatic regression of key links such as login, order placing, inquiry and payment front page.

-Anti-bot compatibility testing in authorized environments.

-Synthetic monitoring of SaaS products to simulate real users accessing key pages.

-Web application stability test under different browser fingerprints, locale, timezone, proxy exports.

Pre-sales value: It can tell customers "to make automated testing closer to the real user's browser and reduce false positives and link interruptions caused by the test environment not being like a real person".

5.2 AI Browser Agent

The browser agent needs to open a web page, click, search, submit a form, and read the page. If the bottom layer uses ordinary Playwright, it is often encountered on real sites:

-Headless be identified.

-CDP automated behavior is recognized.

-Page returns challenge or blank pages.

-Form behavior is too mechanical.

CloakBrowser support Playwright / Puppeteer, and mentioned on the official website can be combined with browser-use, Crawl4AI, Scrapling, Stagehand, LangChain, Selenium and other tools. For AI Agent platforms, CloakBrowser can serve as a "more robust browser execution layer".

Pre-sales value: suitable for "AI Agent tool execution infrastructure", especially the success rate, stability and real environment consistency of web tasks.

5.3 Compliance Data Collection and Internal Research

For teams with legally authorized or open data collection compliance requirements, CloakBrowser can be used to reduce the probability of browser automation being misjudged, such:

-The collection automation of the enterprise's own data platform.

-Signed authorized data supplier acquisition tasks.

-Price, inventory, public opinion, public page monitoring.

-Adversarial sample validation in anti-climbing system research.

Before selling, you must ask clearly: target site, data source, authorization certificate, access frequency, robots/ToS, personal information processing boundary, cross-border compliance, etc.

Red Team Test 5.4 Anti-Fraud/Anti-Climbing Team

If the customer is a risk control, security, anti-crawling, and anti-fraud team, the CloakBrowser can be used as an attack simulation or defense evaluation tool to verify whether their detection strategy only relies on simple browser fingerprints.

Questions suitable for testing include:

-Whether the wind control relies too much on 'navigator.webdriver '.

-Whether CDP behavior, input event exceptions, and browser API inconsistencies can be found.

-Whether to combine multi-dimensional features such as account number, IP address, business behavior, device history, and rate limit.

-How much more robust are existing strategies to attackers with more realistic browser fingerprints.

This is a very valuable pre-sales scenario, because it can change from "evading detection" to "improving customer anti-detection capabilities".

5.5 RPA and Internal Operations Automation

Some enterprise internal systems do not have API and can only be operated through the browser. If a common RPA or Playwright is intercepted by front-end wind control, SSO, or Bot detection, the process will be unstable. CloakBrowser can be used for authorized internal system automation.

Typical example:

-Internal management background batch query.

-Automatic export of supply chain, channel and report system.

-Process regression under the test account.

-Customer authorized business system automation.

6. Not suitable for the scene

The following scenarios do not recommend pre-sales recommendations, and even need to be explicitly rejected:

-Batch registration of account number, number, brush amount and brush evaluation.

-Hit the library, blast the login, bypass the financial/government/medical system authentication.

-Systems that bypass paywalls, access controls, or explicitly prohibit automation.

-Unauthorized large-scale collection of personal information.

-Customer wants to package CloakBrowser binary into their own SaaS or browser cloud offering, but does not have an OEM/SaaS license.

-Items with a commitment requirement that "100 percent of all tests must be bypassed.

7. Technical Architecture Understanding

Architecturally, CloakBrowser is not a substitute for Playwright, but a substitute for Playwright-initiated Chromium.

General Playwright:

CloakBrowser:

The core difference is in the 'C': the browser itself does more in-depth fingerprint consistency processing, rather than just injecting patches into the page.

8. Key Capabilities Teardown

8.1 Source-level fingerprint patches

This is the most important selling point. The official repeatedly stressed that "not JS injection, not config patch", but the C level to change Chromium behavior.

Pre-sale can be interpreted:

-JS stealth plug-ins are like "patching" before web scripts are executed, which is easily bypassed by deeper checks.

-Source-level patches are more like the browser itself answering questions, so cross-API consistency is better.

-Real Wind Control usually does multi-dimensional detection: Canvas, WebGL, Audio, Font, Screen, Timezone, Language, WebRTC, TLS, CDP, mouse and keyboard events, etc. Only one point is not enough.

8.2 Drop-in replacement

Existing Playwright project migration cost is low:

- from playwright.sync_api import sync_playwright
- pw = sync_playwright().start()
- browser = pw.chromium.launch()
+ from cloakbrowser import launch
+ browser = launch()

This selling point is suitable for customers who already have Playwright and Puppeteer script accumulation. Instead of customers overturning the existing automation framework, it replaces the underlying browser runtime.

8.3 Humanize behavior simulation

Example:

from cloakbrowser import launch

browser = launch(
    headless=False,
    humanize=True,
)
page = browser.new_page()
page.goto("https://example.com")
page.click("text=Search")
browser.close()

Suitable for doing:

-Form filling test.

-AI Agent operation web page.

-The user journey returns.

-QA closer to the rhythm of real user operations.

Pre-sales note: don't promise to "open the humanize must pass the wind control", can only say that it reduces obvious mechanical behavior.

8.4 Proxy GeoIP Conformance

Example:

from cloakbrowser import launch

browser = launch(
    headless=False,
    humanize=True,
    proxy="http://user:pass@proxy.example.com:8000",
    geoip=True,
)
page = browser.new_page()
page.goto("https://example.com")
browser.close()

The value of' geoip = True' is to make the browser timezone, locale, language, WebRTC and other signals as consistent as possible with the proxy export location to avoid the contradiction of "IP in the United States, browser time zone is Shanghai, language is another set.

But agent quality is not solved by CloakBrowser. In real projects, IP reputation are often more important than browser fingerprints.

8.5 Persistent profile

Persistence profile can save cookies, localStorage, and session state to avoid being a new browser without history every time.

Applicable to:

-The automated test account retains the login status.

-Synthesis monitoring maintains a stable session.

-AI Agent requires a continuous context.

-Study the effect of browser profile on detection results.

8.6 Docker and Server Deployment

Official Docker image:

docker run --rm cloakhq/cloakbrowser cloaktest

You can also install it in your own image:

FROM python:3.12-slim
RUN pip install cloakbrowser && python -m cloakbrowser install
COPY your_script.py /app/
CMD ["python", "/app/your_script.py"]

For delivery, this means that browser automation tasks can be placed into CI, K8s, server task queues, or Agent execution environments.

9. What do you think of the official test results?

README and official website list a batch of official test results, including reCAPTCHA v3, Cloudflare Turnstile, FingerprintJS, BrowserScan, deviceandbrowserinfo, etc.

The official form claims:

-Stock Playwright usually get lower scores on reCAPTCHA v3, while CloakBrowser can achieve higher scores.

-Cloudflare Turnstile non-interactive or managed scenes can be passed.

-FingerprintJS bot detection show through.

-BrowserScan display normal.

-Signals such as 'navigator.webdriver', plugins, 'window.chrome', UA, CDP, TLS are closer to normal Chrome.

Pre-sales interpretation to be cautious:

These results are official tests, not third-party audits.

1. The detection results will change over time, and anti-detection is a continuous confrontation.
2. The real business site will also look at IP, account number, behavior history, access frequency, transaction context, not only the browser fingerprint.
3. PoC must be done in a customer-authorized environment or on a public testing site, and cannot be promised to be valid for any third-party site.

10. Commercial and licensing focus

This is one of the most risky pre-sales places for this project.

10.1 wrapper and binary are two sets of licenses

The wrapper source code in the GitHub repository is MIT, including Python / JS / . NET wrapper. But really valuable Stealth Chromium binary using CloakBrowser Binary License.

Key information of Binary License:

-The latest major binary usually requires an active paid subscription.

-No redistribue, resell, sublicense, repackage, or binary modification is allowed.

-Internal use, internal Docker, CI runner, internal artifact mirror are generally allowed, subject to version subscription requirements.

-A separate OEM/SaaS license is required if the CloakBrowser is part of a customer-controlled browser capability, Browser-as-a-Service, SaaS, white-label product, hosted service.

-Illegal use is explicitly prohibited, including unauthorized access, database collision, violent login, automated account creation, bypassing system authentication that does not belong to you, fraud and unauthorized data collection.

10.2 Pricing and Concurrency

The official website currently shows that charging is based on concurrent session:

Prices, rights and terms are subject to change and official website and contracts are required before formal quotations.

11. Comparison with Common Scenario

12. The most useful customer speech for pre-sales

12.1 for QA/Test Leader

"It can make our existing Playwright automation closer to the real Chrome user environment and reduce test failures caused by Headless or CDP fingerprints. It is especially suitable for critical link regression that has been connected to bot protection, SSO, CAPTCHA challenge or wind control system."

12.2 AI-oriented Agent Platform Leader

"When AI Agent to do web tasks, the stability of the underlying browser is very important. CloakBrowser can be used as the browser execution layer of Agent, which makes page opening, clicking, form input and jump closer to the real user environment, thus improving the task completion rate."

12.3 for risk control/security team

"It can be used as a red-team testing tool to help verify that existing bot detection rely too much on simple browser fingerprints. If CloakBrowser, a more realistic automated browser, can pass, it means that defense strategies need to strengthen behavior, account, IP reputation, business semantics, and rate models."

12.4 for Data Acquisition Team

"It is not used to bypass the rules, but to reduce the misjudgment caused by the browser automation characteristics in the legal and authorized collection process. Before going online, you need to confirm the authorization, robots, ToS, personal information processing and access frequency."

13. PoC Verification Recommendation

It is recommended to divide PoC into four layers, and do not promise the service site pass rate at the beginning.

13.1 Baseline Comparison

Objective: Compare the differences between native Playwright and CloakBrowser in the same environment.

Verification Items:

-BrowserScan/FingerprintJS and other public detection page results.

-Fingerprint consistency of 'navigator.webdriver', UA, plugins, WebGL, font, timezone, locale, etc.

-Headed/headless two mode performance.

-Whether Python behaves consistently with JavaScript wrapper.

13.2 Customer Authorization Site Verification

Objective: Validation on test environments explicitly authorized by the customer or on own systems.

Verification Items:

-Whether the login link is stable.

-Whether to trigger additional challenge.

-page load, click, input, download, export and other business action success rate.

-How much the retrofit costs compared to the original Playwright script.

-Whether proxies, fixed exports, persistent profile are required.

13.3 production indicators

Objective: Assess whether you can enter the real delivery.

Verification Items:

-Single instance memory and CPU.

-Concurrent session caps and license costs.

-Docker/CI / K8s deployment mode.

-Binary download, caching, signature verification, version pinning.

-Performance in case of failure recovery, timeout, agent failure, license server unavailability.

13.4 Compliance and Safety Review

Objective: To avoid late project stuck in compliance.

Verification Items:

-Proof of data source and authorization.

-Target website ToS/robots/contract terms.

-Whether it involves personal information, sensitive information, cross-border.

-Whether there is an account system, access frequency, and IP pool management policy.

-OEM/SaaS license required.

14. Quick Use Guide

14.1 Python installation

pip install cloakbrowser

Optional GeoIP Capabilities:

pip install "cloakbrowser[geoip]"

Minimal example:

from cloakbrowser import launch

browser = launch()
page = browser.new_page()
page.goto("https://example.com")
print(page.title())
browser.close()

14.2 JavaScript installation

npm install cloakbrowser playwright-core

Playwright style:

import { launch } from "cloakbrowser";

const browser = await launch();
const page = await browser.newPage();
await page.goto("https://example.com");
console.log(await page.title());
await browser.close();

Puppeteer style:

import { launch } from "cloakbrowser/puppeteer";

const browser = await launch({ headless: true });
const page = await browser.newPage();
await page.goto("https://example.com");
await browser.close();

14.3. NET installation

dotnet add package CloakBrowser

Example:

using CloakBrowser;

await using var browser = await CloakLauncher.LaunchAsync();
var page = await browser.NewPageAsync();
await page.GotoAsync("https://example.com");

14.4 Docker

docker run --rm cloakhq/cloakbrowser cloaktest

14.5 Login and License

Try the latest available builds for free:

cloakbrowser login

Environment variables are recommended for production environments:

export CLOAKBROWSER_LICENSE_KEY="cb_..."

Can also pin version, easy to roll back:

from cloakbrowser import launch

browser = launch(
    license_key="cb_...",
    browser_version="148.0.7778.215.5",
)

15. Implement landing recommendations

15.1 Start with low-risk scenarios

Give priority to the customer's own system, test environment, authorized site or public detection page for PoC, do not directly take the third-party high-sensitivity target site verification. This makes it easier for security, legal and operations to accept.

15.2 Keep the original Playwright script

It is recommended that the CloakBrowser be made into switchable backend:

USE_CLOAK = True

if USE_CLOAK:
    from cloakbrowser import launch
    browser = launch(headless=False, humanize=True)
else:
    from playwright.sync_api import sync_playwright
    pw = sync_playwright().start()
    browser = pw.chromium.launch(headless=False)

This can do A/B comparison, but also facilitate the failure of the fallback.

15.3 fixed version and environment

Anti-detection class browser update fast, recommended production environment:

-Fixed wrapper version.

-Fixed binary version.

-Fixed Docker image.

-Record SHA256 / signature authentication.

-Establish grayscale tests to avoid automatic upgrades leading to business regression.

15.4 don't just look at the "pass rate"

It is recommended to record simultaneously:

-Page success rate.

-Trigger challenge ratio.

-Average page load time.

-Single session resource consumption.

-Failure reason classification.

-Cross effect of IP reputation and browser fingerprint.

-Account status and behavioral history impact.

16. Risks and Precautions

16.1 Compliance Risk

This is the first risk. The CloakBrowser's ability is naturally close to anti-detection and automatic confrontation. If the customer's intention is not clear, the use boundary should be confirmed before sales.

It is recommended to state in the program:

-For authorized environments only.

-No collision, bulk registration, fraud, bypass authentication.

-Unauthorized collection of personal information is prohibited.

-Comply with target system ToS, robots, contracts and laws and regulations.

16.2 Commercial Licensing Risk

The latest binary requires a subscription; OEM/SaaS license is required if customers want to embed capabilities into their own SaaS/Browser-as-a-Service/customer controllable processes.

This means that it is not necessarily suitable for brainless integration into products as a "free open source component.

16.3 Sustainability Risk

Anti-detection is continuous confrontation. The test passed today may be invalid tomorrow. Official updates are very frequent, indicating that the project is active and that the external environment is changing rapidly.

Pre-sale can not promise "permanent availability", should promise "verifiable, observable, grayscale, rollback".

16.4 Supply Chain Risk

The core is to download a proprietary Chromium binary. Although the official instructions wrapper verify signatures and checksum, corporate customers still need to evaluate:

-Whether the binary source is trusted.

-Whether it is allowed to run in the intranet.

-Whether to allow access to the license server.

-Whether a security scan is required.

-Whether offline deployment or internal mirroring is required.

16.5 Ethics and Brand Risk

If the project is not carefully expressed, it is easy to be understood as "helping customers bypass the wind control". Pre-sales materials should use more expressions such as "authorization automation stability", "misjudgment reduction", "test environment authenticity" and "red team defense evaluation.

17. Suggested questions to ask first when communicating with customers

1. Is your automation target your own system, authorized system or third-party public website?
2. Are you currently using Playwright, Puppeteer, Selenium, or RPA tools?
3. Is the failure mainly due to page failure, verification code, login failure, challenge, or account/IP being controlled by wind?
4. Are there compliance authorization, access frequency restrictions, and data processing specifications in place?

Do you need massive concurrency? 5, 20, 200 or 2000 session expected?

1. Can I accept paid Pro binary? Does it involve OEM/SaaS resale or customer controllable browser capability?
2. Do you need Docker, K8s, CI, offline deployment or intranet mirroring?
3. Is there an agent, fixed export IP, account pool, and test account?
4. Do I need to integrate with existing Agent platforms, Crawl4AI, LangChain, browser-uses, and Scrapling?
5. Is the acceptance index passing the detection page or the success rate of the business link?

18. How can I write the pre-sales plan page?

18.1 Capability Description

"Based on CloakBrowser, it provides a browser automation running environment closer to real Chrome, is compatible with Playwright / Puppeteer API, and improves the stability of authorized Web automation tasks in real sites through source-level browser fingerprint consistency, behavior humanize, proxy geographic location consistency and persistence profile."

18.2 Value Point

-Reduce false positives from automation features such as Headless / CDP/webdriver.

-Protect existing Playwright / Puppeteer script assets with low migration costs.

-Supports AI Agent, QA, synthesis monitoring, RPA, compliance data collection, and other scenarios.

-Supports Docker and multi-platform deployment for easy entry into engineered delivery.

-Reduce production risks through version pinning, signature verification, and rollback strategies.

18.3 Boundary Declaration

"This program is only used for testing, monitoring, automation and data processing within the scope of customer authorization, and is not used to circumvent third-party access control, batch account registration, database collision, fraud or unauthorized data collection."

19. My overall judgment

CloakBrowser is a project with very clear positioning and relatively complete engineering packaging: it captures the core pain points of Playwright / Puppeteer in real website automation, and also makes "source-level Chromium fingerprint patch native API compatible with Docker License concurrent subscription" into a relatively commercial form.

From a pre-sales perspective, it is very suitable for the following programs:

-AI Agent browser execution layer.

-Authorization Web Automation stability enhancement.

-Enterprise QA/synthetic monitoring.

-Anti-climbing/anti-fraud red team assessment.

-Compliance data collection runtime.

However, it is not suitable to be recommended as an "open source free anti-detection artifact. When the latest version and scale concurrency are really used, the core capabilities rely on proprietary binary and Pro subscriptions. In the case of customer-controlled SaaS/browser service, OEM authorization is also involved. The project capacity is strong, but the pre-sales boundary must also be stronger.

20. Source

-GitHub repository:CloakHQ/CloakBrowser

-Project official website:cloakbrowser.dev

-README:README.md

-Binary License:BINARY-LICENSE.md

-Changelog:CHANGELOG.md

-PyPI:cloakbrowser

-NPM:cloakbrowser