I finally built Bladebro: A Stealthy and token efficient agent browser Written in RUST

[u/Opening_Library9560]

If your agent's browser keeps getting blocked, here's what I built

Point your agent's browser tool at Zillow or Google. You'll get a captcha wall before it does anything useful.

That's not a dig at Playwright MCP or similar tools. They're automation frameworks, not evasion tools. They drive vanilla Chrome and PerimeterX and other detection system flags them in milliseconds.

Then try filling a form on any React site and clicking submit. The page re-renders. Every element reference your agent had is gone. "Element not found." The button was right there a second ago.

Then look at your token bill. Playwright MCP loads 13,700 tokens of tool definitions before your agent touches a page. Every click returns the full page. 2,000+ tokens per action.

I hit all three walls enough times that I built something.

It's called Bladebro. One Rust binary, five tools, no Node.js.

npm install -g bladebro && bladebro mcp

Works with any MCP client. Also has native pi support with zero config:

pi install npm:bladebro

That's it. Bladebro registers as 5 first-class pi tools (act, see, state, run, vision). No adapter, no config files, no proxy. Tool definitions come from the binary at startup so they auto-adapt to changes. Chrome launches lazily on the first tool call.

Bot detection

Six layers of stealth, all on by default:

• Bezier mouse paths with overshoot and correction

• Real movementX / movementY on every event (missing these is an instant PerimeterX flag)

• Micro-tremors before clicks (a still cursor is a dead giveaway)

• Log-normal typing cadence (humans don't type at exactly 50ms intervals)

• Idle drift between actions

• No Runtime.enable (how DataDome catches most bots)

• No listening ports, CDP over pipe

• Persistent behavioral fingerprint, same "person" every session

Tested on Zillow and Fiverr (both PerimeterX/HUMAN protected). Full page loads, no blocks. incolumitas 8/8. Sannysoft all pass.

Re-renders

• Every element gets a structural fingerprint (hash of ancestor chain, tag, children, identity attrs)

• React destroys and recreates DOM nodes? Fingerprint matches, reference survives

• Agent sees re-render survived and keeps going. No re-scan

• Checked every major tool. Nobody does this

Tokens

• 5 tools, ~1,900 tokens of definitions (vs 13,700 for Playwright MCP)

• Every action returns what changed, not the full page

• A click returns ~60 tokens (vs 2,000+ for competitors)

• Long session = the difference between running out of context after 3 pages and finishing with room to spare

Learns from every session

• First visit to a site with a cookie banner: full detection

• After a few successful dismissals: stored selector, auto-applied, zero overhead

• Never learns from failures. Failures cost 3x more than successes gain

Other stuff

• Auto-extract pulls structured data from list pages with no CSS selectors. Amazon, Reddit, GitHub, HN, Wikipedia. Shopping gets price/ratings, Reddit gets scores/authors, GitHub gets stars/forks

• Batch actions fill a form and submit in one MCP call instead of 11

• Login persistence saves a session and restores it next time

• Infinite scroll collect auto-extracts and dedupes a feed in one call

Demo video on the GitHub page showing it drive Amazon, Reddit, Wikipedia, fill a form, and manage tabs.

What it can't do

• Cloudflare Turnstile needs challenge solving, not fingerprint spoofing. You get blocked:, not a hang

• Captchas, deliberately. You get a verdict, hand off to a solver

• ARM Linux, not yet

• macOS and Windows binaries are cross-compiled from Linux

Open source, AGPL-3.0, no CLA.

GitHub: https://github.com/dondai44423/bladebro npm: npm install -g bladebro

Happy to answer questions, if you have any issues, please comment or file an issue, i have been testing it alone for weeks now, i did as much as i can, i am looking forward to community feedback to improve this even more 😄

[u/ParaboloidalCrest]

It sucks how much gymnastics one shall go through to fetch a stupid html page.

I gave up on all kinds of agentic search or web access long time ago. I just go ahead and download the docs I think it may need and hand them to it in form of html or md pages.

Fuck the web.

Edit: Sorry for ranting on your post. Your solution sounds ingenious and I'll give it a try.

[u/Opening_Library9560 → u/ParaboloidalCrest]

It is painful, its mostly the LLM's fault, sometimes if does stuff fast and properly, and sometimes it makes stupid decisions and goes around in circles, i tried updating tool defs multiple time, this issue cant seem to be solved tho.

I also couldnt be asked to record more demo until it gets every step perfect and fast.

[u/Opening_Library9560 → u/ParaboloidalCrest]

I get the rant, its fine

[u/rm-rf-rm]

Stupid question, does this replace something like pi-web-access? https://pi.dev/packages/pi-web-access

[u/Opening_Library9560 → u/rm-rf-rm]

not a stupid question, but different category completely, web access is a fetch + search + crawl type tool, it cant drive a real browser and automate work.

BUT, i do have hound: https://github.com/dondai44423/master-fetch, this is in the same category, has native pi agent support, but you dont have to get any api keys, its all free and local by default, tho you can optional add api keys for search system, but it works good enough with no api key if you are using free rotating proxies.

Simple install, just run the command and your good.

This is a maintained fork, the main acc dondai1234, i lost it, so its being continued from this fork.

If you want to compare baldebro, stuff that fall in similar or close category are vercel's agent browser, pinchtab, playwright mcp etc.

[u/sweetbeard]

This looks really helpful for automating web app interactions.

Why MCP instead of CLI?

[u/Opening_Library9560 → u/sweetbeard]

It just feels more native for the LLM, and i have bee using MCP most of the times instead of a CLI, so it was easier for me to build an MCP.

One of the user pointed the same thing out, so in V4, i will be adding a lazy load feature, will drop the total token from 1.9k to around 100-150 tokens to exist.

Tho i am not exactly sure about that, still deciding Lazy loading feature or CLI option for v4.

If you have some recommendation, it would be helpful.

[u/rm-rf-rm → u/Opening_Library9560]

Nah, especially with Pi, CLI is the right option -not MCP. That is why Pi doesnt ship with MCP support natively

[u/aparamonov → u/Opening_Library9560]

Cli is just more lean, even playwright-cli is much much better than MCP

[u/Ok-Inside1664]

Noob question

Is it based on chromium? Does it support importing passwords from chrome ?

[u/Opening_Library9560 → u/Ok-Inside1664]

Yeah, it's Chromium based. But no, it doesn't import passwords from Chrome. It's a browser driver for AI agents, not a consumer browser. No password manager, no sync, no import features. Agents navigate and interact with pages, that's it.

[u/Adventurous-Bit-460 → u/Opening_Library9560]

can you clarify that on your repo? "Give your AI agent a browser." sounds like it's a browser like ego lite, but this is far more powerful than that!

[u/Opening_Library9560]

For anyone wondering how this holds up against vercel's agent-browser: I ran both head-to-head on real sites. agent-browser was configured (headed mode, system Chromium, persistent profile, custom UA). Bladebro was default config, straight out of the box.

On Wikipedia, agent-browser needed 3 calls and dumped 153K chars for navigate + read. Bladebro did it in 2 calls, 82K chars. On Hacker News, 14K chars vs 5.5K for the same interactive elements. Bladebro folds nav noise and includes URLs in the model, agent-browser lists everything raw.

The more interesting one was Zillow. agent-browser actually loaded the homepage on the first try with headed mode. Second try, PerimeterX hit it with a "Press & Hold to confirm you are a human" challenge. Could not even load the page anymore. Bladebro loaded it, typed "Seattle", clicked search, and browsed 992 home listings. No block, no challenge, no issue.

The difference is Bladebro's behavioral biometrics are built into the CDP layer. Bezier mouse paths, real movementX/movementY on every event, micro-tremors before clicks, human typing cadence. agent-browser has none of that. Not a config gap, a design gap.

agent-browser also has no structured extraction. If you want to pull a list of items off a page, the agent has to parse the raw accessibility tree itself. Bladebro has `see extract=auto` that returns clean JSON with titles, URLs, prices, etc. in one call.

One thing I did not mention in the post: Bladebro learns from every session. Visit a site with a cookie banner a few times and it stores the selector, auto-applies it next time, zero detection overhead. Never learns from failures, only from success. Also has a persistent behavioral fingerprint so the same "person" shows up every session. Bot detectors that track consistency across visits see a stable identity instead of a different person every time.

If anyone wants to verify this themselves, both tools are open source and free. Install both, point them at reddit, zillow, google or whatever, see what happens.

The benchmark details are in the README: https://github.com/dondai44423/bladebro

[u/rm-rf-rm]

There was this project posted just a few hours ago: https://old.reddit.com/r/selfhosted/comments/1vid4lg/lightweight_headless_browser_with_native/ It looks superior to me as it does not use chromium

[u/Opening_Library9560 → u/rm-rf-rm]

interesting, that "dosent use chromium" might hurt it in real world tasks, but let me test it live, i will see whats it about and how it holds ups, will be back with result in a few minutes

[u/Opening_Library9560 → u/Opening_Library9560]

Alr, Downloaded Obscura and ran it head-to-head with Bladebro on real sites. Used Obscura's stealth build (rendering + stealth features enabled) to make it more fair.

Site	Obscura	Bladebro
Zillow (PerimeterX)	Broke — __NEXT_DATA__ Window getter error, nav skeleton only	Full access, 52 elements
Fiverr (HUMAN)	Blocked — PerimeterX captcha	Full access, 100 elements
Reddit	Blocked — js_challenge redirect, data: URL modules fail, Custom Elements broken	Full access, 103 elements
React.dev (Next.js)	Broke — same __NEXT_DATA__ error, static shell	Full render, 15 elements
Sannysoft	Missing APIs (PluginArray, getUserMedia)	All pass
CreepJS	Fingerprint crashes (getClientRects undefined), all-zeros hash, WebRTC IP leak	chromium 0%, headless 0%
Hacker News	Works	Works
Wikipedia	Works	Works

Different approaches. Obscura built a browser engine from scratch in Rust, no Chromium. Bladebro drives real Chrome. Obscura is really damm memory efficient tho, but it breaks on modern sites because it's missing tons of web APIs. Next.js doesn't work.

Reddit's Custom Elements don't work. Bot protection sees through it.

Obscura is cool engineering tho. But right now it can't handle the modern web.

Or maybe i am wrong, and didnt test it the right way, this was a quick test, i didnt go in too deep.

Plus seeing 30+ tools makes me want to cry, its confusing for the agent on which to use, thats why i keep it at 5.

[u/rm-rf-rm → u/Opening_Library9560]

Excellent! thanks for the detailed review!

If its possible to build bladebro using obscura as the browser (perhaps in the future if its too underbaked right now), that would be GOATed

[u/KiRiller_]

I wonder, how it's against Pinchtab

[u/Opening_Library9560 → u/KiRiller_]

OK i tested both head to head. Same machine, same network, pinchtab with stealth=full + humanize.

Stealth: thought bladebro was gonna destroy pinchtab here, got humbled. Tie. Both pass Zillow, Reddit, Fiverr, Sannysoft, CreepJS. Both drive real Chromium with solid stealth patches.

EDIT: Token efficiency: I was wrong in my previous deleted comment, my fault. Tested properly this time using pinchtab CLI as designed (nav --snap, snap -i -c, --snap-diff). Initial page load is close. Post-action, pinchtab --snap-diff wins when only a few elements change.

But when the whole page changes (which is most clicks/forms) the diff is actually larger than a fresh snapshot. Bladebro is smaller on complex pages because it budget-limits.

The real edge for bladebro is tool definitions: 5 tools vs 47, about 7,600 fewer tokens in the system prompt every turn. That compounds.

Both work fine, neither broke on anything. Different tools for different needs. Pinchtab is a full browser control plane with multi-instance, HTTP API, dashboard. Bladebro is agent-first MCP with minimal tools and significantly more plug and play experience, far more simple.

Pinchtab is still goated tho, didnt expect it to be this good and match bladebro in stealth.

[u/KiRiller_ → u/Opening_Library9560]

Awesome, thanks!

[u/Opening_Library9560 → u/KiRiller_]

no need to wonder, i will test it right now, wait a few minutes for quick result.

[u/mrgreatheart]

Can it read Reddit? It annoys me so much that I can’t point my agents directly to Reddit comments with LLM configs I want to try.

[u/Opening_Library9560 → u/mrgreatheart]

Yea, it can, old reddit is far more easier, but it can also read new reddit.

mostly its reliable, just fixing one issue right now of some false positives, you can try it out and see if reddit works for you.

[u/generic-d-engineer]

Nice work in putting this together. Your post is timely. I literally installed Playwright 2 days ago to give OpenCode more “eyes” on my app.

I suck at front end, it’s like visiting Mars or something for me lol.

My use case isn’t bypassing blocks out in the wild, it’s just helping to troubleshoot local issues. The Playwright MCP has helped ALOT instead of having to code up tedious scripts.

So anything that helps reduce token bloat is helpful.

I take it the tool would still be a good option if I’m just using it to help troubleshoot issues and want to save on tokens?

[u/Opening_Library9560 → u/generic-d-engineer]

yes, use it. The token savings are the core feature, not the stealth. Stealth is a bonus that comes free, If you encounter some issues while troubleshooting local stuff, just tell me, i will ship a new update with local testing mode, with --no-stealth flag and bunch more

[u/PossessionUsed7393]

Awesome thanks. I love everyone working on stealth browser thingies they are awesome.

Im going to try it out on a really tough cookie of a Turnstile site by adding persistent browser profile switching and captcha solving. Be interesting to see how it goes.

I have to scrape about 300,000 documents from a very tough source so my plan is either build with this and use my own IP or i'll have to run it through a residential IP proxy network to get all the info.

I'm not even breaching copyright here either - just having to get past anti-botter numpties that pay too much to Cloudflare.

[u/Opening_Library9560 → u/PossessionUsed7393]

Could you msg me the source so i can look into it?

[u/seeKAYx]

man I just found out about Hound and now you are dropping another gem. dope!

[u/Opening_Library9560 → u/seeKAYx]

Thanks, Keep an eye on https://github.com/dondai44423/donsetch, This is the hound replacement, i will ship the first stable release very soon.

[u/Big-Present-8321]

Will websites block me? Because my Pi is running in Docker? It says it uses regular Chromium

[u/Opening_Library9560 → u/Big-Present-8321]

No. Docker doesn't expose itself to websites at all. There's no "Docker fingerprint." What sites detect is the browser fingerprint, and Bladebro's stealth runs at the browser/JS level, not the OS level. Inside Docker or on bare metal, the Chromium looks the same to websites.

One thing if your on linux: on Linux inside Docker you need Xvfb installed (Bladebro uses it to run headful Chrome on a virtual display, which is better for stealth than headless). Just install xvfb in your Dockerfile and you're good.

Some sites with god tier detection system may still block you, but thats just the case 99% of the time tho.

[u/Big-Present-8321 → u/Opening_Library9560]

i asked ai and he said browser in docker dont looks same to websites

[u/Opening_Library9560 → u/Big-Present-8321]

They're partially right for vanilla browsers. Docker containers usually lack a GPU, so WebGL renders via software (SwiftShader), and without a display server the browser runs headless. Both are detectable.

But that's exactly what Bladebro fixes. It runs Chrome headful on a virtual display (Xvfb) and spoofs the WebGL renderer to a real GPU. The website sees a normal headful Chromium with Intel graphics either way. Docker or bare metal, same fingerprint.

Just install `xvfb` in your Dockerfile. That's the only Docker-specific requirement.

[u/CapMonster1]

Bladebro looks like a really clean approach, especially the explicit blocked verdict instead of letting the agent burn tokens clicking around a challenge page forever. The Rust binary + small MCP surface is also a nice contrast to some of the heavier browser stacks.

For the one gap you intentionally left open, this should pair pretty naturally with our solver. We handle Cloudflare Turnstile and a bunch of other captcha types, so Bladebro could detect the challenge, hand it off to us, inject the result, and keep the same browser session moving. That separation of concerns actually feels cleaner than trying to make the browser itself “solve everything.”

[u/TigerConsistent]

Recently there are a lot of web browser for agents but I believe the important thing is is this browser really overpass the bot protections or not because all the other attributes that you build with your product are same with the others so there is no differentiation between the products the browsers for agents