browser-mcp-agent

Anti-Detect Browser - Claude Code Skills

Agent Skills for driving a browser that presents one coherent real device instead of a headless build: persistent isolated profiles, kernel-level fingerprints, and a per-profile proxy whose exit IP sets timezone and WebRTC. They teach an agent how to launch and manage AntiBrow browsers, both by writing code against the SDK (JavaScript or Python) and by letting the agent drive the browser directly via MCP.

Typical uses: QA and bot-detection testing against your own site, checking your own ads and pricing from another region, scraping public data, giving an agent a browser that stays logged in, and keeping identities you own or are authorized to operate in genuinely separate profiles. See Acceptable use.

Skills in this repo

• multi-account-isolation - verifying that profiles are actually isolated rather than assuming it: ten concrete checks (timezone vs exit IP, WebRTC, canvas stability across relaunches, duplicate personas or addresses across a fleet), which detection suites to run, what the runtime does with your credentials, and which layers browser isolation cannot cover at all. Start here if the question is "is my setup actually holding?".
• anti-detect-browser - SDK (npm anti-detect-browser + PyPI antibrow), profiles, fingerprints, proxies, kernel updates, Docker, and the REST API. Use this to write custom scraping, multi-account, or automation scripts.
• browser-mcp-agent - MCP server mode. Use this to let an AI agent (Claude, GPT, etc.) launch and control the browser itself via tool calls, with no code to write.
• multi-account-scraping - running the same scrape or task across many accounts at once, each in its own profile with its own fingerprint, cookies and exit IP, and reading data from sites that need a session or that answer a plain HTTP scraper with a captcha. One command per site returns JSON, so there are no selectors to write or repair: Amazon, Walmart, Google, DuckDuckGo, Reddit, X, Medium, Yelp, Indeed, Hacker News, GitHub, PyPI, npm. Also covers writing a new adapter, and the domain allowlist plus SHA-256 pinning that make a third-party one safe in a profile that holds live logins. Use this when the goal is data from a site, not a browser.

Install

As a Claude Code plugin (recommended)

Installs all four skills together and keeps them updatable via /plugin update:

/plugin marketplace add antibrow/anti-detect-browser-skills
/plugin install anti-detect-browser-skills@antibrow

As individual skills

Works with Claude Code and any other agent the skills CLI supports:

# isolation self-check
npx skills add https://github.com/antibrow/anti-detect-browser-skills --skill multi-account-isolation

# SDK / scripting skill
npx skills add https://github.com/antibrow/anti-detect-browser-skills --skill anti-detect-browser

# MCP agent-driven skill
npx skills add https://github.com/antibrow/anti-detect-browser-skills --skill browser-mcp-agent

# multi-account scraping / per-site JSON commands
npx skills add https://github.com/antibrow/anti-detect-browser-skills --skill multi-account-scraping

# all of them
npx skills add https://github.com/antibrow/anti-detect-browser-skills --all

Or add the repo URL in Claude Code settings under Skills and pick which skill(s) to install.

What makes this different from a stealth plugin

Most stealth tooling patches JavaScript from the outside: override a getter, shim navigator, monkey-patch toString. Anti-bot vendors have been fingerprinting those patches for years - the patch is the tell.

AntiBrow ships a modified Chromium kernel. Canvas, WebGL, WebGPU, audio, fonts, navigator, screen, DOMRect and timezone are answered inside C++/Blink, so:

• there is no injected script to find and no property descriptor out of place;
• Web Workers return exactly what the main thread does (detectors re-read identity inside workers precisely because partial overrides only patch the main thread);
• canvas and WebGL reads are deterministic per profile - a browser that returns a new hash on every read is trivially flagged, and so is one whose OffscreenCanvas disagrees with its 2D canvas;
• WebGL, WebGL2 and WebGPU name one GPU - adapter.info.vendor matches the unmasked renderer family;
• the TLS ClientHello and HTTP/2-3 behaviour are a genuine Chrome build's, because it is one. Nothing running in JavaScript can reach that layer.

Each profile gets one coherent persona sampled from one real machine - 30+ categories, 500+ parameters - frozen at creation and replayed on every later launch. Independently randomized values contradict each other (an AMD renderer beside an Intel vendor string, a 1.0 DPR on a 1536x864 screen); a real device's don't.

Timezone, locale and WebRTC identity follow the proxy: the exit IP is resolved through the proxy before launch. Proxy credentials are answered inside the network stack (HTTP 407, SOCKS5 RFC 1929), so nothing shows up in chrome://extensions.

Want to check any of that yourself: CreepJS, whoer.net, browserleaks.com/canvas, pixelscan.net, or npx liarjs (liarjs.dev) for ~40 open-source cross-layer consistency rules you can run in CI.

Platforms

Two SDKs, one profile format

npm install [email protected] playwright-core   # Node >= 18; pin the version
pip install antibrow==0.9.0                             # Python 3.9 - 3.13

const ab = new AntiDetectBrowser({ key: process.env.ANTI_DETECT_BROWSER_KEY })
const { page, browser } = await ab.launch({ profile: 'shopper-01' })

from antibrow import launch
browser = launch(profile="shopper-01")   # same profile, same fingerprint
page = browser.new_page()

Both share ~/.anti-detect-browser/, so a profile created from Node is launchable from Python (and from the desktop app) with the identical identity. playwright install is never needed - AntiBrow drives its own kernel.

What Claude learns

From multi-account-isolation:

• The configuration invariant - one identity, one profile, one persona, one egress, one timezone; what a shared cell breaks
• Eleven concrete checks - timezone vs exit IP, WebRTC candidates, canvas stability across relaunches, worker vs main thread, one GPU across three interfaces, no duplicate personas or addresses across the fleet
• Which suites to run - CreepJS, whoer, browserleaks WebRTC, pixelscan, and npx liarjs for the ~40 rules you can run unattended in CI
• Reading a failure - the cheap causes (reused profile name, duplicate address, clock/address disagreement, a persona that regenerated) before suspecting the fingerprint
• Runtime transparency - where cookies, personas, proxy credentials and the API key actually go, and how to verify it yourself
• What isolation cannot cover - everything outside the browser, stated plainly

From anti-detect-browser:

• JS/TS SDK - AntiDetectBrowser, launch() options, applyFingerprint() for existing Playwright setups, kernel update APIs, and kernels named by Chrome major (150, 151) since 2.8.0
• Python SDK - launch() / launch_async() / launch_persistent_context() / prepare_launch(), the Antibrow handle, error types, python -m antibrow CLI, env vars, Docker
• Framework integrations - hand the CDP endpoint to browser-u