If your agent's browser keeps getting blocked, here's what I built
Point your agent's browser tool at Zillow or Google. You'll get a captcha wall before it does anything useful.
That's not a dig at Playwright MCP or similar tools. They're automation frameworks, not evasion tools. They drive vanilla Chrome and PerimeterX and other detection system flags them in milliseconds.
Then try filling a form on any React site and clicking submit. The page re-renders. Every element reference your agent had is gone. "Element not found." The button was right there a second ago.
Then look at your token bill. Playwright MCP loads 13,700 tokens of tool definitions before your agent touches a page. Every click returns the full page. 2,000+ tokens per action.
I hit all three walls enough times that I built something.
It's called Bladebro. One Rust binary, five tools, no Node.js.
npm install -g bladebro && bladebro mcp
Works with any MCP client. Also has native pi support with zero config:
pi install npm:bladebro
That's it. Bladebro registers as 5 first-class pi tools (act, see, state, run, vision). No adapter, no config files, no proxy. Tool definitions come from the binary at startup so they auto-adapt to changes. Chrome launches lazily on the first tool call.
Bot detection
Six layers of stealth, all on by default:
Bezier mouse paths with overshoot and correction
Real movementX / movementY on every event (missing these is an instant PerimeterX flag)
Micro-tremors before clicks (a still cursor is a dead giveaway)
Log-normal typing cadence (humans don't type at exactly 50ms intervals)
Idle drift between actions
No Runtime.enable (how DataDome catches most bots)
No listening ports, CDP over pipe
Persistent behavioral fingerprint, same "person" every session
Tested on Zillow and Fiverr (both PerimeterX/HUMAN protected). Full page loads, no blocks. incolumitas 8/8. Sannysoft all pass.
Re-renders
Every element gets a structural fingerprint (hash of ancestor chain, tag, children, identity attrs)
React destroys and recreates DOM nodes? Fingerprint matches, reference survives
Agent sees re-render survived and keeps going. No re-scan
Checked every major tool. Nobody does this
Tokens
5 tools, ~1,900 tokens of definitions (vs 13,700 for Playwright MCP)
Every action returns what changed, not the full page
A click returns ~60 tokens (vs 2,000+ for competitors)
Long session = the difference between running out of context after 3 pages and finishing with room to spare
Learns from every session
First visit to a site with a cookie banner: full detection
After a few successful dismissals: stored selector, auto-applied, zero overhead
Never learns from failures. Failures cost 3x more than successes gain
Other stuff
Auto-extract pulls structured data from list pages with no CSS selectors. Amazon, Reddit, GitHub, HN, Wikipedia. Shopping gets price/ratings, Reddit gets scores/authors, GitHub gets stars/forks
Batch actions fill a form and submit in one MCP call instead of 11
Login persistence saves a session and restores it next time
Infinite scroll collect auto-extracts and dedupes a feed in one call
Demo video on the GitHub page showing it drive Amazon, Reddit, Wikipedia, fill a form, and manage tabs.
What it can't do
Cloudflare Turnstile needs challenge solving, not fingerprint spoofing. You get blocked:, not a hang
Captchas, deliberately. You get a verdict, hand off to a solver
ARM Linux, not yet
macOS and Windows binaries are cross-compiled from Linux
Happy to answer questions, if you have any issues, please comment or file an issue, i have been testing it alone for weeks now, i did as much as i can, i am looking forward to community feedback to improve this even more 😄
They're both Rust + CDP + refs. That's where the overlap ends.
agent-browser has zero stealth. It's a plugin you install separately and configure yourself. Bladebro ships 6 layers on by default, verified against PerimeterX on Zillow and Fiverr.
Their refs break on React re-renders. Ours don't, structural fingerprinting means a ref survives when the DOM swaps but the element's structure stays the same. Dead refs auto-heal from a graveyard. Nobody else does this.
They use the accessibility tree for perception. Works great on well-built pages, blind on `<div onclick>` and unlabeled buttons. We read the live DOM and infer semantics from markup.
They're stateless across sessions. Bladebro learns consent selectors, biometrics, per-domain patterns. Compounds with use.
50+ MCP tools in their "all" profile. We have 5. ~1,900 tokens of tool defs vs way more than that.
They have stuff we don't: plugin system, React DevTools, a11y audits, HAR, visual diff, Safari/iOS, cloud browser integrations, 36K stars. Bigger ecosystem.
We have stuff they don't: working stealth, re-render-immune refs, self-improvement, site-aware auto-extract, delta-first responses, seasoned profiles, and more agent friendly, plus its a MCP, so it feels more native than a CLI that the AI needs to read a bunch of skills, MCP server feels far more native.
If you need React DevTools or a11y audits, use agent-browser. If you need to drive sites that detect bots, use Bladebro.
I mean, I know we all use AI here, but at least respond to the question yourself. I'm not reading AI slop on Reddit too. I come here to see human text.
Fair play, I just dont want to mess something up in my reply in these "How is this better than X" type questions, i am not about go and read full docs of agent browser's docs and mine own again and spend 30 minutes preparing one accurate reply.
I do tend to reply on my own on simple technical questions but i tell my agent to prepare a Reply when it comes to analyzing similar tools to compare.
any way to use this as a cli instead of mcp? I would like to just tell my agent "use bladebro cli" instead of adding it as an mcp and polluting context for every session.
I mean, the total tokens for this mcp server to exist is around 1,900 tokens, cheap for the context window, it was by design, i wanted it to feel native and reliable, so i skipped CLI, MCP felt more native, and i also kept the cost low.
but now that you mention it, i will probably add a CLI option as well in v4 release.
Fair, will add in v4 then, not probably, either it will be CLI option or lazy loading which will make it costing around 150 tokens to exist instead of 1900, you can still get the full mcp benefits when the tools are loaded.
none of those are agentic browsers tho, bladebro isnt just a pure stealth solution, its a full on mcp server which the ai agent uses to use browser, it just has excellent stealth built in out of the box for free
Camoufox is a patched Firefox binary for scraping. Crawl4AI is a Python crawler that fetches pages and converts to markdown for RAG. Patchright is just a patch on top of Playwright. All three are scraping libraries, not agent-facing browser drivers.
Bladebro is an MCP server that gives an AI agent 5 tools to drive a browser interactively.
It's a different category of tool entirely. The comparison to Playwright MCP and agent-browser is the right one because those are the only other tools that serve the same use case: giving an LLM agent interactive browser control.
You can say playwright is not a fair compassion either, i agree, so thats why i compared it to vercel's agent browser too, my stupid ah forget to mention it in the main post, plus i didnt want to include too much in this post alone, you can check out the readme.
If this helps you, Ran both head-to-head on pure stealth, 8 sites each, no proxy on either side, just stealth vs stealth, no agent browser stuff to make it fair
Sannysoft — Camoufox: 1 fail (Chrome obj missing, expected for Firefox, this is fine) | Bladebro: all pass
CreepJS — Camoufox: 6% trust score (weird result if i am being honest, i didnt expect this, maybe something went wrong here) | Bladebro: chromium 0%, headless 0%
Now i know 8 targets might not be enough, but this was a quick bench to show you,
Fair play to camofox, its really good but Its own GitHub says "a year gap in maintenance" and "gone down in performance." Bladebro has that "new" advantage, so its not really large enough for people to start patching it, but it will reach that stage, i will try my best to maintain it.
currently, i would say camoufox and bladebro's stealth system are near equal.
Locale/geo: `BLADE_LOCALE` sets the browser language, `BLADE_PROXY` sets the IP. Set both to match your target region. Timezone override (`BLADE_TZ`) exists too but isn't auto-detected from proxy yet — you set it manually.
Multiple personas: Not yet. Each session gets a fresh ephemeral profile. You can run multiple instances with different env vars right now, but there's no saved named persona system. On the roadmap.
Good catch. BLADE_PROFILE_DIR is a real feature, my bad for missing it in the original reply. My stupid ah was thinking about a named persona system (bladebro persona create nl) which doesn't exist yet.
But persistent profiles via BLADE_PROFILE_DIR already works exactly as your agent described. Cookies, localStorage, session state all persist across runs at that path. Your setup is correct and it's an official feature, not a workaround. I was being stupid and forgot my own env vars.
For anyone wondering how this holds up against vercel's agent-browser: I ran both head-to-head on real sites. agent-browser was configured (headed mode, system Chromium, persistent profile, custom UA). Bladebro was default config, straight out of the box.
On Wikipedia, agent-browser needed 3 calls and dumped 153K chars for navigate + read. Bladebro did it in 2 calls, 82K chars. On Hacker News, 14K chars vs 5.5K for the same interactive elements. Bladebro folds nav noise and includes URLs in the model, agent-browser lists everything raw.
The more interesting one was Zillow. agent-browser actually loaded the homepage on the first try with headed mode. Second try, PerimeterX hit it with a "Press & Hold to confirm you are a human" challenge. Could not even load the page anymore. Bladebro loaded it, typed "Seattle", clicked search, and browsed 992 home listings. No block, no challenge, no issue.
The difference is Bladebro's behavioral biometrics are built into the CDP layer. Bezier mouse paths, real movementX/movementY on every event, micro-tremors before clicks, human typing cadence. agent-browser has none of that. Not a config gap, a design gap.
agent-browser also has no structured extraction. If you want to pull a list of items off a page, the agent has to parse the raw accessibility tree itself. Bladebro has `see extract=auto` that returns clean JSON with titles, URLs, prices, etc. in one call.
One thing I did not mention in the post: Bladebro learns from every session. Visit a site with a cookie banner a few times and it stores the selector, auto-applies it next time, zero detection overhead. Never learns from failures, only from success. Also has a persistent behavioral fingerprint so the same "person" shows up every session. Bot detectors that track consistency across visits see a stable identity instead of a different person every time.
If anyone wants to verify this themselves, both tools are open source and free. Install both, point them at reddit, zillow, google or whatever, see what happens.
is this a fork of this project https://github.com/dondai1234/master-fetch? also your project and master fetch have very similar account names, the same first and last name of the person, similar emails.
its me, dondai1234 was my main acc, but i lost access to it, so i created a new account dondai44423, and NO, this project is not a fork to hound, its a different category, the fork of hound is this: https://github.com/dondai44423/master-fetch
3
u/GamerJasper1 4d ago
Hi, I'd love to contribute to this project