Because the tool surface is upstream Playwright MCP unchanged, anything already written against it runs here with no edits — what changes sits underneath: CloakBrowser's Chromium, persistent profiles, loaded extensions, humanised input, and a proxy whose GeoIP can be matched to the fingerprint's timezone and locale. One tool is honestly named: browser_run_code_unsafe executes arbitrary JavaScript inside the Playwright server process and is equivalent to remote code execution, so keep it out of any surface you do not fully control.
A bridge that runs upstream @playwright/mcp as the canonical tool surface and points that runtime at CloakBrowser's Chromium, adding two introspection tools of its own. Anything already written against Playwright MCP keeps working unchanged.
- The upstream Playwright MCP tools unchanged: navigate and go back, click, hover, type, fill a whole form at once, press keys, select options, drag and drop, upload and drop files, resize, manage tabs, wait for text or time
- An accessibility snapshot as the basis for acting, with screenshots kept for looking rather than for clicking
- That snapshot searched by text or regular expression, returning the matching nodes with surrounding context
- Console messages filtered by level, and a numbered network-request list with full headers and body available for any one of them
- JavaScript evaluated against the page or a specific element, and — labelled unsafe in its own name — an arbitrary Playwright snippet run in the server process
- Dialogs handled, and artifacts written to a configurable output directory
- Persistent Chromium profiles, validated context options (viewport, locale, timezone, permissions, geolocation, headers) and Chrome extension directories loaded
- GeoIP-aware proxy matching, so the fingerprint's timezone and locale line up with the proxy's country
- Humanised mouse, keyboard and scroll behaviour for flows that watch how you interact
- Two local tools reporting the resolved browser binary and the bridge's own runtime metadata
- Session code generated in typescript, python, java or csharp, or turned off
Node.js 22.13 or newer in the 22.x line, or Node.js 24 and above. npx -y cloakbrowser-mcp@latest runs it over stdio, and its doctor command checks the environment before you wire a client up. --transport streamable-http with --http-port serves HTTP instead, bound to 127.0.0.1 on port 3000 by default. Docker images are published for linux/amd64 and linux/arm64, write artifacts to /data, and set CLOAK_PLAYWRIGHT_MCP_NO_SANDBOX to true by default because Chromium sandboxing is often unavailable in containers — set it false where your runtime supports it, and keep network access and mounted directories tightly scoped for untrusted pages. PLAYWRIGHT_MCP_BROWSER_ENGINE switches between cloak and plain playwright, PLAYWRIGHT_MCP_HEADLESS defaults to true, and PLAYWRIGHT_MCP_USER_DATA_DIR has to be set before extensions can load.
One command — npx -y cloakbrowser-mcp@latest