Consider use of CloakBrowser instead of Playwright

[arabold]

https://github.com/CloakHQ/CloakBrowser

CloakBrowser is an open-source drop-in replacement for Playwright and Puppeteer that uses a custom Chromium binary with 49 source-level patches to bypass bot detection, passing live tests from Cloudflare Turnstile, reCAPTCHA v3 (0.9 score), and multiple fingerprinting services. The tool requires just three lines of code to implement and includes optional humanized mouse/keyboard behavior, persistent browser profiles, and Docker support, positioning itself as a self-hosted alternative to commercial anti-detect browsers like Multilogin and GoLogin.

[daveCode-dot]

A few caveats worth weighing before swapping Playwright for CloakBrowser as the default scraper for a docs MCP server:

1. Trust surface — CloakBrowser ships a custom Chromium binary with 49 source-level patches. For a self-hosted MCP server users install via npx, that means downloading and running an unaudited Chromium fork by default. Playwright pulls upstream Chromium from Microsoft-signed mirrors; the supply-chain story is materially different.

2. Use-case fit — docs-mcp-server's primary input is open documentation sites, not bot-protected SaaS dashboards. Playwright's anti-bot weaknesses mostly bite when scraping Cloudflare-Turnstile-protected targets, which is rarely where API/library docs live (those want to be indexed). The bypass capability is overkill for the dominant use case.

3. Maintenance velocity — Playwright has a salaried Microsoft team and ships fixes in days. CloakBrowser is a small project; if upstream Chromium ships a security CVE, the lag to a patched fork matters for anything embedded in user agent contexts.

A pragmatic middle path: keep Playwright as the default, expose a scraper config option (playwright | cloakbrowser | custom), and let users opt in to CloakBrowser for the specific docs hosts that block Playwright. That way you get the bypass capability for the cases that actually need it without making every install carry the patched-Chromium attack surface.

[arabold]

Great feedback. Thanks!

[markg85]

Cloudflare-Turnstile-protected targets, which is rarely where API/library docs live (those want to be indexed). The bypass capability is overkill for the dominant use case.

This is unfortunately not entirely true or not as positive as you make it sound. Now i'm not running this project (yet) but i have some experience scraping sites that i too believed to be just plain hosting their site. Just to later, when results got borked, figure out that cloudflare was intervening. This really is on a LOT of websites. There are also other platforms. I did a little digging in the first API url i found here on your github issues and came across this one: #381 who fetches https://peoplevox.help.descartesservices.com/en/integrations/peoplevox-api-guide. It's not cloudflare. It's openresty which also has bot protection. You might not hit it, great! But you should assume that you will hit that at some point and then it's going to become a massive headache to figure out what even is going wrong.

That being said, it's probably a good thing to try and not get detected as bot and use the best tools available for that. It's pain you can delay or prevent which is good!

[saasverdict]

Hey @arabold — worth evaluating. CloakBrowser's pitch (patched Chromium, drop-in Playwright/Puppeteer swap, Docker) is attractive if you want self-hosted and avoid commercial licensing.

I tested similar patched-Chromium approaches alongside AdsPower and Dolphin before settling on a longer-term stack. CloakBrowser's 49 source-level patches do help on lighter targets — Turnstile, reCAPTCHA v3 scoring, basic fingerprint checks. The three-line drop-in is genuinely nice for prototyping.

Where I hit limits vs commercial anti-detect (and why I'd keep CloakBrowser as a dev/prototype path, not primary prod infra):

• Patch maintenance burden — Cloudflare/DataDome update detection weekly. Custom Chromium builds need constant rebasing; commercial vendors absorb that ops cost
• Profile isolation at scale — CloakBrowser offers persistent profiles, but multi-tenant case/account separation (fingerprint + cookies + proxy per identity, team access control) is where Multilogin/GoLogin invest heavily
• Managed challenges — patched binary helps first pass; enterprise per-path WAF (DataDome on listing URLs, council portals on Lambda) often needs session reputation + behavioral history, not just fingerprint patches
• Concurrency stability — under scheduled CI or 10+ parallel sessions, I've seen patched-Chromium stacks drift or get re-flagged faster than kernel/profile-level isolation
• Proxy + fingerprint alignment — binding residential/mobile egress per profile with consistent TLS/Canvas/WebGL across weeks-long sessions is tighter in Multilogin than ad-hoc Docker + patched Chrome

Practical recommendation for this repo:

Phase	Tool
Spike / local dev	CloakBrowser — low friction, validate if your targets pass
Production / strict targets	Multilogin X — profile isolation, stable CDP API, proxy-per-profile

If CloakBrowser clears your specific Cloudflare tier in CI, ship it. If you hit managed challenges or fingerprint drift after a few runs, that's the ceiling of patch-only approaches.

I ended up on Multilogin X for production because CDP integration is stable at the profile level, Canvas/WebGL/TLS stay consistent across restarts, and proxy binds per profile — important when detection stacks score session trust, not just binary patches.

Wiring Multilogin + CDP (or comparing it head-to-head against CloakBrowser on your targets) is fiddly. I open-sourced boilerplate scripts + a setup guide with side-by-side Playwright hookup patterns — partner code SAAS50 (50% off): https://t.me/Multilogin_Scripts_Bot

Suggested eval for #400: run the same scraper against CloakBrowser and Multilogin on your hardest URL (the one that currently fails). If CloakBrowser passes 10/10 over 24h with your proxy setup, it's a win. If it degrades to 3/10 by day 2, that's the maintenance/isolation gap.

Open-source vs commercial isn't ideological here — it's whether your targets and run frequency outgrow patch-only Chromium.

[AminDhouib]

Another option worth considering alongside CloakBrowser — we built an MCP server on nodriver that avoids the Playwright detection surface entirely. Includes persistent session management and automated stealth flag stripping.

https://github.com/DevinoSolutions/stealth-chrome-devtools-mcp