Camofox Browser is an anti-detection browser server for AI agents built on Camoufox, a Firefox fork that spoofs fingerprint surfaces — navigator.hardwareConcurrency, WebGL renderers, AudioContext, screen geometry, WebRTC — at the C++ level before JavaScript can observe them. It wraps that engine in a REST API designed for agents: accessibility snapshots instead of raw HTML, stable element references (e1, e2, …) for clicking and typing, and search macros for common sites.
Each user gets an isolated browser context with its own cookies and storage; tabs are grouped by session key, sessions expire after 30 minutes of inactivity, and the browser shuts down after 5 minutes without active sessions and relaunches on the next request, so idle memory stays around 40 MB. When a session reaches its tab limit the least-used tab is recycled rather than returning an error. Cookies and localStorage persist to disk so an authenticated session survives restarts; Netscape-format cookie files can be imported behind an API key, and a VNC plugin allows interactive login through noVNC with export of the resulting storage state.
Traffic can route through a single proxy or a backconnect gateway with rotating sticky sessions per context, with locale, timezone, and geolocation derived from the proxy's exit IP through Camoufox's GeoIP. Further endpoints extract YouTube transcripts via yt-dlp, list page images and captured downloads, attach files from a configured upload directory, run structured extraction against a JSON Schema whose properties map to snapshot refs, and record per-session Playwright traces viewable in Trace Viewer.
It runs as an OpenClaw plugin that exposes tools such as camofoxcreatetab, camofoxsnapshot, camofoxclick, and camofoximportcookies, or standalone from npm or Docker with deployment recipes for Fly.io and Railway. Anonymised crash and hang telemetry is on by default and files GitHub issues through a Cloudflare Worker whose source is in the repository; it can be disabled with CAMOFOXCRASHREPORT_ENABLED=false or pointed at a self-hosted endpoint. Logs are JSON lines with request IDs, and an OpenAPI spec is served at /openapi.json.
Features
- C++-level anti-detection: Camoufox spoofs hardware, graphics, audio, screen, and WebRTC signals below the JavaScript layer
- Accessibility snapshots: compact page representations with element refs, optional base64 screenshots, and offset-based pagination for large pages
- Session isolation and persistence: per-user contexts, tab groups by session key, and storage state saved under ~/.camofox/profiles/
- Cookie import: Netscape-format files injected into a session, gated by CAMOFOXAPIKEY, capped at 500 cookies and 5 MB
- Proxy and GeoIP: simple or backconnect proxies (Decodo, Bright Data, Oxylabs) with fingerprint locale and timezone matched to the exit IP
- Search macros: @googlesearch, @youtubesearch, @amazonsearch, @redditsearch, @wikipediasearch, @linkedinsearch, and others; Reddit macros return JSON directly
- YouTube transcripts: /youtube/transcript via yt-dlp with a slower browser-based fallback
- Structured extract: POST /tabs/:tabId/extract with a JSON Schema mapped to refs via x-ref
- Downloads, images, and uploads: capture browser downloads, list elements with inline data, and attach files from a sandboxed directory
- Session tracing: opt-in Playwright traces (screenshots, DOM, network, console) with list, fetch, and delete endpoints
- VNC interactive login: noVNC access to the live browser for manual sign-in, then storage-state export for agent reuse
- Deployment and access control: Docker, Fly.io, and Railway recipes; CAMOFOXACCESSKEY bearer auth for all routes beyond loopback
