Ghostfox — the agent-native stealth browser you can own

demo — real sessions, real captures

An agent books dinner, passes detection, replays its work

why

Hosted stealth browsers see your cookies. You should see yours.

AI agents get blocked (headless Chrome trips Cloudflare on ~20% of the web), and the hosted "stealth browser" platforms route your agent's identities, cookies and sessions through someone else's cloud. Ghostfox is the self-hosted alternative: a complete browser stack you run yourself.

	Ghostfox	Hosted stealth (Browserbase, …)	playwright-mcp	Anti-detect suites (Multilogin, …)
Self-hosted	✓	✗	✓	partial
Open source	✓ (engine + runtime)	✗	✓	✗
MCP-native	✓	✓	✓	✗
Engine-level anti-detect	✓ C++ / Firefox	vendor partnerships	✗	✓ (closed)
Coherent, audited identities	✓ 500/500	✗	✗	partial
Session evidence & replay	✓	✗	✗	✗
Runtime language	Rust	—	Node	—

architecture

One stack, both halves yours

Firefox (MPL-2.0)
  └─ Camoufox (anti-detect patches, by daijro)
       └─ Ghostfox engine          engine/   — patches, branding, builds
            └─ Ghostfox runtime    runtime/  — Rust: sessions, identities, MCP

The runtime speaks Juggler natively from Rust — zero Python, zero Node at runtime. The engine is your own fork of the Camoufox build system: rebased when you want, branded your way, and it survives any upstream licensing change (upstream has signaled partially-closed future patches — forks that don't own their engine inherit that risk).

quickstart

Running in three minutes

# 1) install (engine + runtime, Linux x86_64)
curl -fsSL https://raw.githubusercontent.com/autokeren/ghostfox/main/install.sh | bash

# 2) wire into any MCP client
{
  "mcpServers": {
    "ghostcloak": {
      "command": "~/.ghostfox/mcp/ghostcloak-mcp",
      "env": { "GHOSTFOX_HOME": "~/.ghostfox/engine" }
    }
  }
}

Or Python: pip install ghostfox · Or Docker: docker run ghcr.io/autokeren/ghostfox

See & understand

page_a11y — semantic snapshot with refs, roles, names, live values, login_state. Pierces shadow DOM + iframes. Then page_read_ref for full values, page_wait_for for element readiness, page_screenshot for pixels.

Act by ref

page_click_ref · page_type_ref · page_upload_file — no CSS selectors. Rich editors (Lexical, Draft) handled via editor-native paste paths with fire-then-verify receipts. Every mutation returns proof it landed.

Identity & evidence

identity_generate · identity_audit · session_evidence — coherent personas (Windows · macOS · Linux · Android), audited before use. Every session writes an append-only event log, snapshots, screenshots and the identity used. Replay what your agent did.

Session health

login_state in every a11y snapshot — agents detect dead sessions before acting, not after. Plus captcha_solve for when you're challenged anyway.

signatures

Details competitors don't have

Touch-coherent Android personas — navigator.maxTouchPoints patched at the C++ level, coarse pointer media queries, touch events, portrait viewports from the identity's screen class. The engine patch (engine/patches/navigator-touch-spoofing.patch) activates a config key that is dead even in upstream Camoufox.
Main-frame discipline — page evaluation is routed to the page's main frame only; iframe contexts (ad frames, srcdoc tricks) can't hijack snapshots or clicks.
Live view — set GHOSTFOX_LIVE_VIEW_PORT and watch your agent work in a browser tab.

numbers

Measured, not claimed

Check	Result
Identity coherence (500 generated)	500/500 pass, 0 violations
Live-target probe (4 targets, datacenter IP)	4/4 OK, 0 gated
bot.sannysoft.com	webdriver clean · WebGL=Mozilla · UA coherent
MCP round-trip E2E	create → open → fill → submit → evidence

Methodology and honest caveats (datacenter IP bias, the expected "Chrome missing" row): runtime/docs/benchmark.

license & credits

Standing on giants, honestly

engine/ is MPL-2.0 (Firefox → Camoufox by daijro → Ghostfox). runtime/ is MIT OR Apache-2.0. Plus LibreWolf (patch tooling lineage) and Playwright (the Juggler protocol).

Pre-alpha research tool. Do not use against targets you don't have permission to test.