Two things usually break a browser agent: the site spots the automation, and the login is gone by the next session. Both are addressed head-on — detectable Chrome flags are stripped and the strip list is handed back to you, and a master profile holding your cookies is cloned per session and auto-suffixed when one is already open. Headed runs are the part it cannot paper over: the window appears on the desktop of whichever process launched the shared backend, so a spawn from SSH fails loudly rather than returning a browser nobody can see.
Browser automation built on nodriver over CDP rather than Puppeteer or Playwright, with profile management that keeps your logins between sessions and flag filtering that strips the Chrome arguments which give automation away.
- Browser instances spawned headed or headless, several at once, with proxy, custom user agent, viewport, timezone and extra headers
- Chrome flags that would expose the automation stripped automatically — automation markers, fingerprint leaks, Puppeteer and Playwright defaults — and reported back in spawn_diagnostics.stealth_args_stripped
- A master profile carrying your real logins, cloned per session so a second run does not fight the first, with a busy github-session becoming github-session-2 on its own
- The ordinary page surface: navigate, back, forward, reload, query by CSS or XPath, click, type, paste, select, scroll, wait for an element, screenshot, read HTML and text
- File uploads set directly on the input element through CDP instead of through a blocking OS dialog
- Tabs listed, opened, switched and closed
- Network capture with search and pagination, request and response detail, response bodies re-fetched on demand, JSON export, and capture filters to keep memory down
- Cookies read, set and cleared, and request headers modified for future requests
- Element extraction in depth — computed styles, DOM structure, event listeners and framework handlers, CSS animations and transforms, images, fonts and backgrounds — inline, progressively with expand calls, or written to a file
- JavaScript run in the page, in a chosen execution context, or as a persistent function that survives reloads; global functions and object methods discovered; signatures inspected; raw CDP Runtime commands as the escape hatch
- Python authored for the browser, transpiled and executed, and Python bindings that JavaScript can call back into
- Dynamic hooks that intercept network requests with your own Python, with documentation, worked examples and a validator for the hook code
Python 3.11 or newer, plus Chrome, Chromium or Microsoft Edge on the machine. uvx stealth-chrome-devtools-mcp is the documented launch. Headed browsing needs a real desktop session: sessions share one backend keyed by display context, and a spawn with headless=False raises rather than handing back an invisible window when no backend can show one — stealth-chrome-devtools doctor reports which contexts have a backend, and headless spawns work from SSH, CI and services. Profiles live under STEALTH_MCP_BROWSER_SESSION_ROOT, which defaults to C:\stealth-mcp-browser-sessions on Windows and ~/.stealth-mcp-browser-sessions elsewhere; on a shared Windows machine move that inside your user profile so the OS permissions cover your cookies. Storage stays bounded by STEALTH_MCP_CLONE_STORAGE_CAP_GB, default 10, and STEALTH_MCP_BROWSER_SESSION_STORAGE_CAP_GB, default 20, with evicted clones recoverable from sessions/.trash for 24 hours. Crash reports go to the maintainers by default with machine name, username and local variables stripped; STEALTH_MCP_NO_ERROR_REPORTING=true turns that off.
One command — pip install stealth-chrome-devtools-mcp==2.0.6