Skip to main content
Glama
WhiteNightShadow

camoufox-reverse-mcp

launch_browser

Launches the Camoufox anti-detection browser or attaches to an existing session, configuring fingerprint, proxy, headless mode, and other evasion settings for automated web interactions.

Instructions

Launch the Camoufox anti-detection browser, or attach to a running one.

Args: headless: Run in headless mode (default False). os_type: OS fingerprint - "auto", "windows", "macos", or "linux". locale: Browser locale (e.g. "zh-CN"). "auto" detects system locale. proxy: Proxy server URL (e.g. "http://127.0.0.1:7890"). humanize: Enable humanized mouse movement. geoip: Auto-infer geolocation from proxy IP. block_images: Block image loading. block_webrtc: Block WebRTC to prevent IP leaks. enable_trace: Enable engine-level property access tracing. Requires camoufox-reverse custom browser build. When enabled, use trace_property_access() to capture DOM access. trace_objects: Optional exact native object-name allowlist (for example ["navigator", "screen", "webgl"]). Empty traces all native sites declared by the selected reverse build. trace_max_events: Per Firefox process/session event cap (1..200000). browser_version: Select one already-installed Camoufox 0.5+ browser without changing its persistent active version. Use a repo-qualified selector such as "official/beta.30" or "whitenightshadow/152.0.4-beta.30-reverse.5". Omit it to preserve the active/default behavior, including Camoufox 0.4.x installations. The selected browser must match the active browser's exact version/build because Camoufox reads shared resources from active. ws_endpoint: Attach to an already-running Camoufox server instead of launching a new browser. Start the server with python -m camoufox server, copy its "Websocket endpoint: ws://127.0.0.1:/" line, and pass that full URL here. When set, all other launch args (os_type/locale/proxy/...) are ignored — fingerprint config is owned by the running server. Start the server with an os fingerprint matching the host for font-metric parity (attach mode cannot inject the host/os font-fallback shim that launch mode does). close_browser() will only disconnect; the server keeps running.

Returns: dict with status, config, and page list.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
geoipNo
proxyNo
localeNoauto
os_typeNoauto
headlessNo
humanizeNo
ws_endpointNo
block_imagesNo
block_webrtcNo
enable_traceNo
trace_objectsNo
browser_versionNo
trace_max_eventsNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv1.6.0
    • addedInput schema / properties / browser_version
      Added value: +{
      +  "title": "Browser Version",
      +  "type": "string"
      +}
    • addedInput schema / properties / trace_max_events
      Added value: +{
      +  "default": 100000,
      +  "title": "Trace Max Events",
      +  "type": "integer"
      +}
    • addedInput schema / properties / trace_objects
      Added value: +{
      +  "items": {
      +    "type": "string"
      +  },
      +  "title": "Trace Objects",
      +  "type": "array"
      +}
  2. Changed4 schema fields changedv1.1.1
    • removedInput schema / properties / proxy / anyOf
      Removed value: -[
      -  {
      -    "type": "string"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]
    • removedInput schema / properties / proxy / default
      Removed value: -null
    • addedInput schema / properties / proxy / type
      Added value: +"string"
    • addedInput schema / properties / ws_endpoint
      Added value: +{
      +  "title": "Ws Endpoint",
      +  "type": "string"
      +}
  3. Changed1 schema field changedv1.0.0
    • addedInput schema / properties / enable_trace
      Added value: +{
      +  "default": false,
      +  "title": "Enable Trace",
      +  "type": "boolean"
      +}
  4. First observedv0.3.0

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral disclosure burden and does so thoroughly. It reveals that attach mode ignores all other launch arguments, that close_browser() in attach mode only disconnects while the server keeps running, that enable_trace requires a custom camoufox-reverse build, and that browser_version must match the active browser's exact build. These non-obvious side effects and constraints are exactly what an agent needs to avoid misusing the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but systematically organized with an Args block and a Returns line, one parameter per line, and logical grouping. It front-loads the core purpose and devotes space only where needed for complex behavior. Given 13 parameters and two distinct modes, no sentence feels redundant or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers launch and attach modes, parameter interdependencies, operational caveats (server persistence, font-metric parity, shared resources), and the return value shape as a dict with status, config, and page list. Even without an output schema, the agent has enough information to call the tool correctly and interpret the result at a high level. No critical details are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by documenting all 13 parameters in the Args block. Each parameter gets meaningful context: defaults, allowed values ('auto', 'windows', 'macos', 'linux'), operational effects (block_webrtc prevents IP leaks), mutual exclusion (ws_endpoint ignores other args), and cross-dependencies (enable_trace requires a specific build). This goes far beyond what the bare schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise action: 'Launch the Camoufox anti-detection browser, or attach to a running one.' It identifies the exact resource and clearly distinguishes between the two operational modes. This cannot be confused with sibling tools like navigate or take_screenshot, which presuppose an active browser.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The ws_endpoint documentation explicitly states when to use attach mode versus launch mode, including the instruction to start a server with `python -m camoufox server` and pass the full websocket URL. It also cautions that in attach mode all other launch args are ignored and that close_browser() will only disconnect, not shut down the server. This gives the agent clear conditional guidance for choosing the right invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.