{ "markdown": "
\n\n\"Ghostfox\"\n\n# Ghostfox\n\n**The agent-native stealth browser you can own.**\n\nSelf-hosted · Open source · MCP-first · Engine-level anti-detect\n\n[![License](https://img.shields.io/badge/engine-MPL--2.0-orange)](engine/LICENSE)\n[![License](https://img.shields.io/badge/runtime-MIT%2FApache--2.0-blue)](runtime/LICENSE-MIT)\n[![Engine](https://img.shields.io/badge/engine-Firefox%20152-red)](engine/README.md)\n\n\"Ghostfox\n\n[![Watch the full demo](https://img.shields.io/badge/watch-full%20demo%20(video)-a78bfa)](docs/demo.mp4) · [Docs site](https://autokeren.github.io/ghostfox/)\n\n
\n\n---\n\nAI agents get blocked. Headless Chrome triggers Cloudflare 403s on ~20% of the\nweb, and hosted \"stealth browsers\" route your agent's cookies, identities and\nsessions through someone else's cloud.\n\nGhostfox is the alternative: a **complete browser stack you run yourself** —\na fingerprint-coherent stealth engine plus a Rust MCP runtime, in one repo.\n\n```\nFirefox (MPL-2.0)\n └─ Camoufox (anti-detect patches, by daijro)\n └─ Ghostfox engine engine/ — spoofing at the C++ level\n └─ Ghostfox runtime runtime/ — Rust: sessions, identities, MCP\n```\n\n| | Ghostfox | Hosted stealth (Browserbase etc.) | playwright-mcp | Anti-detect suites (Multilogin etc.) |\n|---|---|---|---|---|\n| Self-hosted | **✓** | ✗ | ✓ | partially |\n| Open source | **✓** | ✗ | ✓ | ✗ |\n| MCP-native | **✓** | ✓ | ✓ | ✗ |\n| Engine-level anti-detect | **✓ (C++/Firefox)** | vendor partnerships | ✗ | ✓ (closed) |\n| Coherent identities + auditor | **✓** | ✗ | ✗ | partial |\n| Runtime language | **Rust** | — | Node | — |\n\n**Android personas too** — `session_create {\"platform\": \"android\"}` gives\nportrait screens, Adreno/Mali GPUs, Android font stacks and Firefox-on-Android\nUAs, all audited like desktop identities (500/500 coherent, see\n[runtime/docs](runtime/docs/benchmark-2026-09-08.md)).\n\n**One identity, no contradictions.** Identities are generated from coherent\ndevice presets (platform, screen, GPU, fonts that actually ship together),\ninjected at the engine level, and audited before use — a spoofed browser's\nworst enemy is itself saying \"4 cores on a MacBook\".\n\n## Quickstart\n\n> Requires: Rust toolchain, Linux x86_64. Prebuilt engine binaries: see\n> [Releases](../../releases).\n\n```bash\n# 1) Get the engine (prebuilt) and unpack it somewhere, e.g. /opt\nunzip ghostfox--lin.x86_64.zip -d /opt/ghostfox\n\n# 2) Build the runtime\ngit clone https://github.com/autokeren/ghostfox.git\ncd ghostfox/runtime\ncargo build --release\n\n# 3) Wire it into any MCP client (Claude Code, Cursor, ...)\n```\n\n```json\n{\n \"mcpServers\": {\n \"ghostcloak\": {\n \"command\": \"/path/to/ghostfox/runtime/target/release/ghostcloak-mcp\",\n \"env\": { \"GHOSTFOX_HOME\": \"/opt/ghostfox\" }\n }\n }\n}\n```\n\nThen the agent can: `session_create` → `page_open` → `page_snapshot` →\n`page_click` / `page_type` / `page_fill` / `page_press` / `page_eval` / `page_screenshot`, plus\n`identity_generate` / `identity_audit` / `session_evidence` / `captcha_solve`.\n\nEvery mutation returns a **receipt** — `page_fill` reports `landed_chars`, so a\nsilent page swap can't eat a fill unnoticed. And sessions can run **headful**\n(`{\"headful\": true}`) when humans want to watch the agent work.\n\n**Every run records evidence.** Each session writes an append-only event log\n(`events.jsonl`), full page snapshots and the identity it used under\n`~/.ghostfox/recordings/` — fetch it any time with `session_evidence`.\n\n**Or install in one command** (Linux x86_64):\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/autokeren/ghostfox/main/install.sh | bash\n```\n\nFrom source end-to-end (build the engine yourself):\nsee [engine/README.md](engine/README.md) — `make dir && make build`.\n\n## Repository layout\n\n```\nruntime/ Rust: ghostcloak-{core,fingerprint,mcp,eval} (MIT OR Apache-2.0)\nengine/ Browser fork: patches, branding, build system (MPL-2.0)\n```\n\nTwo directories, two licenses, one product. The runtime speaks\n[Juggler](https://github.com/microsoft/playwright) natively — no Node, no\nPython at runtime.\n\n## Why own the engine?\n\n- **Anti-detect that survives inspection.** Spoofing happens inside the\n engine (navigator, screen, WebGL, fonts, WebRTC, timezone, audio) — not in\n injected JS that detectors can read.\n- **No cloud dependency.** Your agent's identities and cookies never touch a\n third-party host.\n- **Upstream insurance.** `engine/` tracks [daijro/camoufox](https://github.com/daijro/camoufox)\n as `upstream`; Ghostfox applies its own branding and can rebase whenever it\n wants — including if upstream patches go closed-source.\n\n## Status\n\nPre-alpha. Verified: identity coherence (500/500), full MCP round-trip\nE2E (create → open → fill → submit), multi-page sessions. Known limits are\ntracked in the changelogs under `runtime/` and `engine/`.\n\n**Do not use against targets you don't have permission to test.** This is a\ntesting / research tool.\n\n## Credits\n\nGhostfox stands on the shoulders of giants —\n[Camoufox](https://github.com/daijro/camoufox) (daijro) for the anti-detect\npatch stack, [Mozilla Firefox](https://www.mozilla.org/firefox/) for the\nengine, [LibreWolf](https://librewolf.net/) for the patch tooling lineage, and\n[Playwright](https://github.com/microsoft/playwright) for the Juggler protocol.\n\n## License\n\n- `engine/` — **MPL-2.0** (inherited from Firefox / Camoufox). See [engine/LICENSE](engine/LICENSE).\n- `runtime/` — **MIT OR Apache-2.0**. See [runtime/LICENSE-MIT](runtime/LICENSE-MIT).\n", "bytes": 5690, "sha": "bcb5c99df3705d2b2c9b226d339ee309465e7d42453ee7a73d3afff0c400c123", "repo_slug": "autokeren/ghostfox", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_autokeren_ghostfox_04b5e51f/readme" }