cloak-browser-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| --caps | No | Comma-separated list of capability groups to enable (`all` or a subset: network, storage, vision, pdf, testing, devtools, config, humanize). | |
| --geoip | No | Boolean flag: auto-resolve geolocation from the proxy exit IP. Default off. | |
| --proxy | No | HTTP(S) or SOCKS5 proxy URL, optionally with inline credentials, e.g. http://user:pass@proxy.example.com:8080. | |
| --headed | No | Run the browser headed (visible). This is the default. | |
| --locale | No | BCP-47 locale, e.g. en-US. Defaults to the system locale. | |
| --headless | No | Run the browser headless for batch/CI usage. Default is headed (visible browser). | |
| --humanize | No | Boolean flag: enable Bézier-curve mouse movement and typo-correcting keyboard input. Default off. | |
| --timezone | No | IANA timezone, e.g. America/New_York. Defaults to the system timezone. | |
| --viewport | No | Viewport size as WxH, e.g. 1920x1080. Default is 1280x720. | |
| --max-pages | No | Maximum number of concurrent tabs. Default 20. | |
| --self-test | No | Boolean flag: print the tool list and exit. | |
| --user-agent | No | User-agent string. Defaults to the CloakBrowser default. | |
| --profile-dir | No | Absolute path to a persistent user-data directory. Defaults to an ephemeral profile. | |
| --download-dir | No | Directory where downloaded files land. Default is the current working directory. | |
| --allowed-domains | No | Comma-separated host patterns (supports wildcards like *.example.com) that browser_navigate may visit. Default open. | |
| --blocked-domains | No | Comma-separated host patterns that browser_navigate may not visit. Checked before allowed-domains. Default none. | |
| --fingerprint-seed | No | Integer seed for deterministic canvas/WebGL noise. Default random. | |
| --upload-allow-dir | No | Restrict file-upload source paths for browser_file_upload and browser_drop to this directory. Default none. | |
| --enable-unsafe-eval | No | Boolean flag: allow browser_run_code_unsafe, which executes JavaScript in the Node.js server process. Default off. | |
| CLOAKBROWSER_VERSION | No | Pin a specific CloakBrowser Chromium version. | |
| CLOAKBROWSER_BINARY_PATH | No | Path to an audited CloakBrowser Chromium binary, bypassing the default download location. | |
| CLOAKBROWSER_LICENSE_KEY | No | CloakBrowser Pro license key. Without it the free binary tier is used. | |
| CLOAKBROWSER_DOWNLOAD_URL | No | Override the download URL for the CloakBrowser Chromium binary (default https://cloakbrowser.dev). | |
| CLOAKBROWSER_SKIP_CHECKSUM | No | Set to `true` to skip SHA-256 verification of the downloaded binary. Default `false`. | |
| CLOAKBROWSER_RELEASE_CHANNEL | No | CloakBrowser release channel: `stable` or `preview`. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| browser_navigateB | Load a URL in the active tab. Returns a fresh snapshot after navigation. |
| browser_navigate_backB | Go back one entry in the active tab's history. |
| browser_tabsC | List, create, switch between, or close tabs. |
| browser_clickC | Click an element by ref or selector. |
| browser_typeC | Type text into an editable field. Use --humanize for natural per-character timing. |
| browser_hoverC | Hover over an element. |
| browser_dragC | Drag from one element to another. |
| browser_dropC | Drop files or data onto an element. |
| browser_select_optionC | Select one or more options in a dropdown. |
| browser_press_keyC | Send a single key or key combination at page level. |
| browser_handle_dialogC | Respond to the next dialog (alert/confirm/prompt/beforeunload). |
| browser_file_uploadA | Upload files to the active file chooser. Paths must be inside --upload-allow-dir if set. |
| browser_fill_formC | Populate multiple form fields in one call. |
| browser_scrollC | Scroll the page or an element by a pixel amount. |
| browser_snapshotA | Capture an accessibility-tree snapshot of the active page. Returns a structured outline with [eN] refs you can pass to interaction tools. |
| browser_findA | Search the accessibility snapshot of the current page for text or a regular expression. Returns matching snapshot nodes with a few lines of context, each under its path from the root, which is cheaper than a full snapshot when you only need to locate an element and its ref. |
| browser_emulate_mediaA | Emulate CSS media features for the page, for example switch between the light and dark color scheme. Omitted parameters are left unchanged; null clears an override. |
| browser_take_screenshotC | Capture a screenshot of the page or a specific element. |
| browser_console_messagesC | Retrieve buffered console/pageerror output for the active tab. |
| browser_wait_forC | Wait for time, text appearance/disappearance, or selector state. |
| browser_resizeC | Resize the viewport. |
| browser_evaluateC | Run a JavaScript function inside the page. Function source must be an arrow or function expression. |
| cloak_set_fingerprintB | Apply a fingerprint profile to the active context. Some fields (seed, GPU, screen) require recreating the context — current pages will be reopened on the same URL. |
| cloak_set_timezoneB | Live-override the timezone for the active context via CDP (no relaunch). |
| cloak_set_localeB | Override navigator.language and Accept-Language for the active context. |
| cloak_set_geolocationC | Set the geolocation reported by navigator.geolocation. Pass fromProxyIp=true to auto-resolve from proxy exit IP. |
| cloak_set_proxyA | Replace the current proxy. This recreates the BrowserContext (state is preserved if --profile-dir was used; otherwise cookies are lost). |
| cloak_detection_testC | Load a well-known bot-detection probe page and dump its key result fields. |
| cloak_stealth_auditA | Programmatic stealth audit. Reports navigator.webdriver, plugin count, WebGL vendor/renderer, languages, user agent, hardwareConcurrency, deviceMemory, permissions, chrome.runtime presence, and a canvas fingerprint hash. |
| cloak_request_signal_inspectA | Open the target URL in an ephemeral background tab and capture per-request connection signals: response status, security details (TLS protocol/issuer), response headers, and request headers (Accept-Language, User-Agent, Sec-CH-UA-*). |
| cloak_persistent_profile_createB | Create a fresh persistent profile directory under ~/.cloak-browser-mcp/profiles/. Use as --profile-dir on next launch. |
| cloak_persistent_profile_listA | List all profile directories under ~/.cloak-browser-mcp/profiles/. |
| cloak_persistent_profile_deleteB | Delete a profile directory. Requires confirm=true. The active session is unaffected. |
| cloak_binary_infoA | Report installed CloakBrowser binary version, tier (free or pro), platform, and cache path. |
| cloak_binary_updateA | Force CloakBrowser to check for and download the latest Chromium build. May take several minutes (~200MB). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 35 tools
Most tools have a clearly distinct action (click, hover, type, scroll, evaluate), and descriptions are detailed enough to separate them in most cases. However, a few pairs overlap meaningfully: browser_type vs browser_fill_form, browser_drag vs browser_drop, and the three cloak audit tools (detection_test, stealth_audit, request_signal_inspect) all serve similar verification goals, so an agent could hesitate.
All names use snake_case with predictable browser_ and cloak_ prefixes, which is readable. But verb position is inconsistent across the server: the browser_ namespace is mostly verb-first, while cloak_ mixes verb-first set_* tools with noun-first names like persistent_profile_list, detection_test, and request_signal_inspect, so conventions are mixed rather than uniform.
35 tools is heavy for a single server, and the surface includes granular operations like browser_drag and browser_drop that could plausibly be merged. The count is somewhat justified because the server spans two large domains (browser control and fingerprint/stealth management), but it still sits well above the typical well-scoped range.
Core browser automation (navigation, interaction, forms, snapshots, screenshots, console, waiting, JS evaluation) and stealth configuration (fingerprint, timezone, locale, geolocation, proxy, profiles, binary management) are broadly covered. Missing are common browser-management operations such as cookie/storage access, network interception or route mocking, download handling, and explicit context/browser teardown, which leaves some minor workflow gaps.