invisible-playwright-mcp

A stealth Firefox, exposed as an MCP server, so an AI agent can browse and act on real websites without being blocked by anti-bot systems.

It wraps invisible-playwright, a real Firefox patched at the C++ source, and hands your client the usual browser tools: navigate, click, type, read, screenshot. The fingerprint is set inside the engine, not bolted onto the page.

First, one prerequisite

Python 3.11 or newer, on Windows (x86_64) or Linux (x86_64, arm64) - macOS is not supported, the last engine build for it was firefox-20. Then uv, because the command below starts with uvx:

curl -LsSf https://astral.sh/uv/install.sh | sh              # Linux

irm https://astral.sh/uv/install.ps1 | iex                   # Windows

Then pick one

Do you already use an AI assistant that can run tools? If yes, it brings the model and you add this browser to it. If no, or if you would rather watch the work happen, there is an interface that brings a model too.

claude mcp add -s user stealth -- uvx invisible-playwright-mcp

claude mcp list

uvx aihawk ui --openrouter-key sk-or-...

The download nobody warns you about

The browser is about a quarter of a gigabyte and it is not fetched when the server is installed, nor when it starts. It arrives on the first tool call that needs a page, so the first thing you ask your assistant to do sits there, and on a slow connection you get a timeout that says nothing about a download.

Get it over with first, in a terminal where you can watch it:

uvx invisible-playwright fetch

Cached afterwards, and shared with anything else that uses this engine. Per-platform sizes are in the engine's README.

Config file

For any client that takes a JSON block rather than a command:

{
  "mcpServers": {
    "stealth": {
      "command": "uvx",
      "args": ["invisible-playwright-mcp"]
    }
  }
}

Where it goes:

Settings from the table below go in the same block, under env:

{
  "mcpServers": {
    "stealth": {
      "command": "uvx",
      "args": ["invisible-playwright-mcp"],
      "env": {
        "STEALTHFOX_PROXY": "http://user:pass@proxy.example.com:8080",
        "STEALTHFOX_SEED": "4242"
      }
    }
  }
}

Settings

Environment variables, all optional. A proxy is the one worth adding: without it the exit IP, timezone and locale are your own machine's, which is a real gap between what the browser says it is and where it appears to be.

Tools

session_new_page, session_list_pages, session_select_page, session_close_page, browser_navigate, browser_read_text, browser_snapshot, browser_read_html, browser_click, browser_click_at, browser_type, browser_press_key, browser_evaluate, browser_take_screenshot, browser_select_option.

The order to try them in

The server hands every client this ladder, because a model that cannot find a way down it invents one:

1. A named tool with a selector - browser_click, browser_type, browser_select_option, browser_press_key. browser_snapshot supplies the selector.
2. Coordinates - the snapshot reports at: [x, y] for every element, and browser_click_at moves the pointer there. For a canvas, a slider, a map, a widget built out of divs.
3. A screenshot - browser_take_screenshot, then browser_click_at on what you can see. For what the snapshot does not list at all.
4. browser_evaluate, to READ what none of the above can see.

browser_evaluate reads; it will not act. Assigning to value, checked or selected, or calling click(), dispatchEvent() or submit(), is refused, and the refusal names the tool to use instead. Script reaches the page with no keystroke and no pointer, so the event carries isTrusted false, which is the clearest signal a page can collect that nobody is really there. Reading those properties is fine.

browser_click_at takes viewport coordinates instead of a selector, moves the pointer there rather than teleporting, and optionally holds before releasing - for a slider, a canvas-drawn challenge, or a press-and-hold.

browser_snapshot returns the title, the url and the visible interactive elements rather than the accessibility tree. Every element carries at: [x, y], its centre in the viewport, and a selector as well when one can reach it - pass that straight to browser_click or browser_type. browser_read_html returns reduced markup instead, for when the structure is what matters.

Tool names mirror the Microsoft Playwright MCP, so prompts written for it work here too.

Why each of those returns what it does, with the measurements behind it: docs/tool-design.md.

More than one client on the same browser

Over stdio the browser belongs to the client that opened it. Set STEALTHFOX_MCP_TRANSPORT=http and it does not: the session is owned by the server, so a second client can attach to the browser the first one left open, and closing a client no longer kills the browser.

To SEE the browser rather than share it, use AIHawk from column 2, which shows the live page beside the conversation.

STEALTHFOX_MCP_TRANSPORT=http uvx invisible-playwright-mcp

Notes

• Bring your own proxy. The engine does the stealth; a residential proxy gives you the matching IP and geography. Without one it still runs, but the exit is your own address.
• This is a browser, not a captcha solver. It does not solve or bypass challenges for you; it makes an ordinary Firefox session look like a real one.

License

MIT, the same as the engine it wraps.