MultiZen

What it is

MultiZen is a desktop app that runs a library of isolated browser profiles. Each profile has its own cookies, login state, fingerprint, and proxy, and runs on your choice of engine — CloakBrowser (Chromium) or Camoufox (Firefox). A local MCP server on 127.0.0.1:7777 exposes browser-drive tools (navigate, click, type, extract, screenshot, evaluate JS, cookies, tabs, waits) to any MCP client.

The result: your AI agent in Cursor or Claude Desktop can complete real authenticated workflows. Cookies and session state survive between launches, so logins and context carry over across AI sessions.

Related MCP server: chrome-bridge

Install

macOS

The cleanest path. Homebrew handles the Gatekeeper quarantine for you:

brew tap multizenteam/multizen
brew install --cask multizen

Or grab the DMG straight from the releases page and run this once after install to bypass the unsigned-app warning:

xattr -cr /Applications/MultiZen.app

Linux

curl -LO https://github.com/multizenteam/multizen-browser/releases/latest/download/MultiZen-linux-x86_64.AppImage
chmod +x MultiZen-linux-x86_64.AppImage
./MultiZen-linux-x86_64.AppImage

Some distros need libfuse2 (apt install libfuse2t64 on Ubuntu 24.04+).

On Ubuntu 24.04+ (and other kernels that restrict unprivileged user namespaces) the browser's sandbox is blocked by default. On the first affected launch MultiZen offers a one-time secure setup: it installs a small AppArmor profile that re-permits the sandbox for just this browser (one password prompt). The sandbox then stays on with no warning banner. You can also run or re-run it later from Settings. If you decline or it can't run, MultiZen launches the browser without the sandbox so it still works.

Prefer to do it by hand? Settings shows the exact command; it writes /etc/apparmor.d/multizen-cloakbrowser and loads it with apparmor_parser. To force sandbox-off regardless, launch the AppImage with --no-sandbox.

Windows

Download MultiZen-win-x64.exe. SmartScreen may flag the installer as unrecognized on first download. Click More info, then Run anyway.

One-liner installer

For macOS and Linux:

curl -sSL https://getmultizen.com/install.sh | bash

How it works

+----------------------+         +-----------------------+
|  Cursor / Claude     |  MCP    |  MultiZen Desktop App |
|  Desktop / Cline     | <-----> |  127.0.0.1:7777       |
+----------------------+         +-----------+-----------+
                                             |
                                             | spawn / drive (CDP)
                                             v
                              +--------------+--------------+
                              |  Profile A  |  Profile B  | ...
                              |  cookies    |  cookies    |
                              |  proxy LU   |  proxy US   |
                              |  Win 145    |  macOS 145  |
                              +-------------+--------------+
                                            |
                                            v
                                  patched Chromium binary
                                  (canvas, WebGL, audio,
                                   font, WebRTC fingerprints
                                   spoofed at C++ level)

Each profile is a real Chromium window with persistent state on disk. The MCP server speaks the standard Anthropic Model Context Protocol over Streamable HTTP (plus legacy SSE) so it works with any client. Browser-drive tools call into Chrome DevTools Protocol under the hood.

Features

Onboarding

Connect an agent (Codex, Cursor, Claude Desktop)

After installing, the MCP server starts on 127.0.0.1:7777. It serves the current Streamable HTTP transport at http://127.0.0.1:7777/mcp (plus a legacy HTTP+SSE endpoint at /sse for older clients).

The server requires a bearer token — it is generated on first run and shown in the app under MCP → Connect an agent (also written to the mcp-token file in the app data directory). Every client config below must send it as Authorization: Bearer <token>. Replace <token> with your own. The app's MCP panel has a Copy for LLM button that hands the whole setup (token included) to a coding agent if you'd rather not edit config files by hand.

Codex CLI (~/.codex/config.toml) — connects to Streamable HTTP directly:

[mcp_servers.multizen]
url = "http://127.0.0.1:7777/mcp"
http_headers = { Authorization = "Bearer <token>" }

JSON URL clients — Cursor (~/.cursor/mcp.json), Cline, Continue:

{
  "mcpServers": {
    "multizen": {
      "url": "http://127.0.0.1:7777/mcp",
      "headers": { "Authorization": "Bearer <token>" }
    }
  }
}

Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json on macOS) — its config has no url field, so bridge the endpoint through mcp-remote (needs Node):

{
  "mcpServers": {
    "multizen": {
      "command": "npx",
      "args": ["mcp-remote", "http://127.0.0.1:7777/mcp", "--header", "Authorization: Bearer <token>"]
    }
  }
}

Restart your client. The agent now has the full tool set — profile lifecycle (list_profiles, launch_profile, close_profile), page driving (navigate, click, type, extract, screenshot, evaluate_js), tabs (list_tabs, new_tab, activate_tab, close_tab), cookies (get_cookies, set_cookies), waits (wait_for_load, wait_for_navigation, wait_for_selector), and raw cdp_send.

Stack

Develop

git clone https://github.com/multizenteam/multizen-browser
cd multizen-browser
yarn install
yarn dev            # launch the desktop app in dev mode
yarn mcp:dev        # run the MCP server standalone for testing
yarn typecheck      # strict TS across all workspaces
yarn build          # full release build (mac/win/linux per OS)

Requires Node 22+ and Yarn 4 (via Corepack).

Repo layout

apps/
  desktop/                Electron + React + Tailwind GUI + main process
packages/
  mcp-server/             MCP server exposing the browser-drive tools
  cdp-driver/             Thin wrapper around chrome-remote-interface
  profile-manager/        SQLite profile CRUD + encrypted local storage
  settings-store/         App-level settings persistence
  types/                  Shared TypeScript types
.github/
  workflows/release.yml   Matrix build, tag-triggered

Roadmap

Things landing in upcoming releases.

• Behavioral injection: humanized mouse paths, keystroke timing, scroll jitter applied at the CDP input layer.

• Per-profile cloud sync (opt-in, end-to-end encrypted): so the same profile follows you across laptops.

• Team workspaces: shared profile pool with audit log.

Why MultiZen vs the alternatives

Acceptable use

Building a multi-account browser is dual-use. We support QA testing across roles and regions, agency workflows you are authorized to run, market research, multi-marketplace e-commerce ops, AI-driven sales engineering, and personal accounts you legitimately own. We do not support platform ToS violations, mass account farming, ban evasion, or fraud. Full policy at getmultizen.com/acceptable-use.

License

MIT. Use it however you want.