← Back to search

io.github.overtimepog/CloakMCP

overtimepog Scanned 1d ago

Stealth browser MCP server — anti-detection Chromium with snapshot-first agent interface

D
52.5 / 100

Versions

2.0.1latest
first seen Jun 5, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 27

cloak_launch
annotations: none low

Launch a stealth CloakBrowser instance. All anti-detection is ON by default. CloakBrowser is a source-patched Chromium passing Cloudflare Turnstile, reCAPTCHA v3 (0.9 score), FingerprintJS, BrowserScan, and 30+ detectors. Args: headless: Run headless. Some aggressive sites need headed mode (False). proxy: Proxy URL (e.g. 'http://user:pass@proxy:8080'). Residential recommended. humanize: Human-like mouse/keyboard/scroll (default: True). human_preset: 'default' or 'careful' (slower, more deliberate). stealth_args: Apply stealth fingerprint args (default: True). timezone: IANA timezone (e.g. 'America/New_York'). locale: BCP 47 locale (e.g. 'en-US'). geoip: Auto-detect timezone/locale from proxy IP. fingerprint_seed: Fixed seed for consistent identity across sessions. user_data_dir: Persistent profile path (cookies/localStorage survive restarts). viewport_width: Viewport width in pixels (default: 1920 headless; 1280 headed fallback, or auto-detected). viewport_height: Viewport height in pixels (default: 947 headless; 800 headed fallback, or auto-detected). color_scheme: 'light', 'dark', or 'no-preference'. user_agent: Custom user agent override. extra_args: Additional Chromium CLI flags.

geoip bool proxy string locale string headless bool humanize bool timezone string extra_args string user_agent string color_scheme string human_preset str stealth_args bool user_data_dir string viewport_width string viewport_height string fingerprint_seed string
cloak_close
annotations: none low

Close the stealth browser and release all resources. Always call when done.

cloak_new_page
annotations: none low

Open a new browser page/tab. Optionally navigate to a URL. Args: url: URL to navigate to after creating the page.

url string
cloak_list_pages
annotations: none low

List all open pages with their IDs and URLs.

cloak_snapshot
annotations: none low

Capture the page's accessibility tree — the PRIMARY way to understand pages. Returns interactive elements with [@eN] ref IDs for use with cloak_click, cloak_type, cloak_select, etc. Call this BEFORE interacting with a page. full=False (default): interactive elements only — compact and fast. full=True: includes surrounding text content for reading context. This is FASTER, CHEAPER, and MORE RELIABLE than screenshots. Always prefer this over cloak_screenshot for deciding what to click. Args: page_id: Target page ID from cloak_launch or cloak_new_page. full: Include text content alongside interactive elements. max_length: Max characters to return (default: 12000).

full bool page_id str max_length int
cloak_click
annotations: none low

Click an element by its [@eN] ref ID from cloak_snapshot. Auto-retries once if the element moved. Returns an updated snapshot. Args: page_id: Target page ID. ref: Ref ID from snapshot (e.g. '@e5' or 'e5').

ref str page_id str
cloak_type
annotations: none low

Type text into an input by its [@eN] ref ID from cloak_snapshot. Clears the field first by default. Set submit=True to press Enter after. Returns an updated snapshot. Args: page_id: Target page ID. ref: Ref ID from snapshot (e.g. '@e3' or 'e3'). text: Text to type. clear: Clear field before typing (default: True). submit: Press Enter after typing (default: False).

ref str text str clear bool submit bool page_id str
cloak_select
annotations: none low

Select a dropdown option by ref ID. Provide one of: value, label, or index. Returns an updated snapshot. Args: page_id: Target page ID. ref: Ref ID of the <select> element. value: Option value attribute to select. label: Option visible text to select. index: Option index (0-based) to select.

ref str index string label string value string page_id str
cloak_hover
annotations: none low

Hover over an element by ref ID. Returns an updated snapshot. Args: page_id: Target page ID. ref: Ref ID from snapshot.

ref str page_id str
cloak_check
annotations: none low

Check or uncheck a checkbox/radio by ref ID. Returns an updated snapshot. Args: page_id: Target page ID. ref: Ref ID from snapshot. checked: True to check, False to uncheck.

ref str checked bool page_id str
cloak_read_page
annotations: none low

Get the page content as clean, readable markdown. Best for reading articles, docs, search results, or any content-heavy page. Strips navigation, ads, footers — returns just the main content. Much more token-efficient than raw HTML (60-80% savings). Args: page_id: Target page ID. max_length: Max characters to return (default: 50000).

page_id str max_length int
cloak_screenshot
annotations: none low

Take an annotated screenshot with element indices overlaid. Each numbered element maps to [@eN] refs from cloak_snapshot. Use when you need VISUAL context — images, charts, CAPTCHAs, or layout. For most interactions, prefer cloak_snapshot() instead. Returns: file path to saved PNG, element count. Args: page_id: Target page ID. full_page: Capture entire scrollable page (default: viewport only).

page_id str full_page bool
cloak_navigate
annotations: none low

Navigate to a URL. Auto-waits for the page to settle (network idle + DOM stable). Handles Cloudflare challenge pages with extra wait time. Returns an updated snapshot of the loaded page. Args: page_id: Target page ID. url: URL to navigate to. timeout: Navigation timeout in milliseconds.

url str page_id str timeout int
cloak_back
annotations: none low

Navigate back in browser history. Returns an updated snapshot. Args: page_id: Target page ID.

page_id str
cloak_forward
annotations: none low

Navigate forward in browser history. Returns an updated snapshot. Args: page_id: Target page ID.

page_id str
cloak_press_key
annotations: none low

Press a keyboard key (Enter, Tab, Escape, ArrowDown, etc.). Returns an updated snapshot. Args: page_id: Target page ID. key: Key name (DOM KeyboardEvent key).

key str page_id str
cloak_scroll
annotations: none low

Scroll the page. Returns an updated snapshot. Args: page_id: Target page ID. direction: 'up' or 'down'. amount: Pixels to scroll.

amount int page_id str direction str
cloak_wait
annotations: none low

Wait for the page to settle (no DOM mutations + network idle). Use after actions that trigger dynamic content loading. Returns whether the page settled and how many DOM mutations occurred. Args: page_id: Target page ID. timeout_ms: Max wait time in milliseconds (default: 5000).

page_id str timeout_ms int
cloak_evaluate
annotations: none low

Execute JavaScript in the page context and return the result. Args: page_id: Target page ID. expression: JavaScript expression to evaluate.

page_id str expression str
cloak_close_page
annotations: none low

Close a specific page by ID. Args: page_id: Page ID to close.

page_id str
cloak_network_intercept
annotations: none low

Intercept network requests — block, mock, or passthrough. Args: page_id: Target page ID. url_pattern: Glob pattern (e.g. '**/api/**', '**/*.png'). action: 'block', 'mock', or 'continue'. mock_body: Response body for 'mock' action. mock_status: HTTP status for 'mock' action. mock_content_type: Content-Type for 'mock' action.

action str page_id str mock_body str mock_status int url_pattern str mock_content_type str
cloak_network_continue
annotations: none low

Remove a network interception rule. Args: page_id: Target page ID. url_pattern: Same pattern used in cloak_network_intercept.

page_id str url_pattern str
cloak_get_cookies
annotations: none low

Get all cookies from the page's browser context. Args: page_id: Target page ID.

page_id str
cloak_set_cookies
annotations: none low

Set cookies in the page's browser context. Args: page_id: Target page ID. cookies: List of cookie dicts with name, value, domain, path.

cookies string page_id str
cloak_pdf
annotations: none low

Save the current page as a PDF file. Args: page_id: Target page ID. format: Page format — 'A4', 'Letter', 'Legal'. print_background: Include background graphics.

format str page_id str print_background bool
cloak_console
annotations: none low

Get browser console output (log/warn/error/info) and JS errors. Args: page_id: Target page ID. clear: Clear the message buffer after reading.

clear bool page_id str
cloak_downloads
annotations: none low

Get list of files downloaded by the browser on a page. Returns downloaded file info including suggested filenames and local paths. After clicking a download link, call this to retrieve the downloaded file path. Args: page_id: Target page ID.

page_id str

Permissions 3

filesystem low
Server uses filesystem capabilities via: os, pathlib
shell high
Server uses shell capabilities via: subprocess
env_vars low
Server uses env_vars capabilities via: os.getenv()

Scan Findings 79

low
Tool 'cloak_back' has no annotations annotation_checker · 100%
low
Tool 'cloak_forward' has no annotations annotation_checker · 100%
low
Tool 'cloak_press_key' has no annotations annotation_checker · 100%
low
Tool 'cloak_scroll' has no annotations annotation_checker · 100%
low
Tool 'cloak_wait' has no annotations annotation_checker · 100%
low
Tool 'cloak_evaluate' has no annotations annotation_checker · 100%
low
Tool 'cloak_new_page' has no annotations annotation_checker · 100%
low
Tool 'cloak_list_pages' has no annotations annotation_checker · 100%
low
Tool 'cloak_close_page' has no annotations annotation_checker · 100%
low
Tool 'cloak_network_intercept' has no annotations annotation_checker · 100%
low
Tool 'cloak_network_continue' has no annotations annotation_checker · 100%
low
Tool 'cloak_get_cookies' has no annotations annotation_checker · 100%
low
Tool 'cloak_set_cookies' has no annotations annotation_checker · 100%
low
Tool 'cloak_pdf' has no annotations annotation_checker · 100%
low
Tool 'cloak_console' has no annotations annotation_checker · 100%
low
Tool 'cloak_downloads' has no annotations annotation_checker · 100%
high
Remote transport without authentication auth_checker · 70%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: mcp@1.20,<2.0 (GHSA-3qhf-m339-9g5v) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (GHSA-9h52-p55h-vw2f) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (GHSA-j975-95f5-7wqh) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (GHSA-jpw9-pfvf-9f58) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (GHSA-vj7q-gjh5-988w) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (PYSEC-2026-1616) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (PYSEC-2026-1617) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (PYSEC-2026-1618) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (PYSEC-2026-3482) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.20,<2.0 (PYSEC-2026-3483) dependency_analyzer · 95%
medium
Vulnerable dependency: cloakbrowser@0.3 (GHSA-mf33-gv72-w2h5) dependency_analyzer · 95%
medium
Vulnerable dependency: cloakbrowser@0.3 (PYSEC-2026-2420) dependency_analyzer · 95%
low
Tool 'cloak_launch' has no annotations annotation_checker · 100%
low
Tool 'cloak_close' has no annotations annotation_checker · 100%
low
Tool 'cloak_snapshot' has no annotations annotation_checker · 100%
low
Tool 'cloak_click' has no annotations annotation_checker · 100%
low
Tool 'cloak_type' has no annotations annotation_checker · 100%
low
Tool 'cloak_select' has no annotations annotation_checker · 100%
low
Tool 'cloak_hover' has no annotations annotation_checker · 100%
low
Tool 'cloak_check' has no annotations annotation_checker · 100%
low
Tool 'cloak_read_page' has no annotations annotation_checker · 100%
low
Tool 'cloak_screenshot' has no annotations annotation_checker · 100%
low
Tool 'cloak_navigate' has no annotations annotation_checker · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: cloak_launch manifest_parser · 90%
info
Tool: cloak_close manifest_parser · 90%
info
Tool: cloak_snapshot manifest_parser · 90%
info
Tool: cloak_click manifest_parser · 90%
info
Tool: cloak_type manifest_parser · 90%
info
Tool: cloak_select manifest_parser · 90%
info
Tool: cloak_hover manifest_parser · 90%
info
Tool: cloak_check manifest_parser · 90%
info
Tool: cloak_read_page manifest_parser · 90%
info
Tool: cloak_screenshot manifest_parser · 90%
info
Tool: cloak_navigate manifest_parser · 90%
info
Tool: cloak_back manifest_parser · 90%
info
Tool: cloak_forward manifest_parser · 90%
info
Tool: cloak_press_key manifest_parser · 90%
info
Tool: cloak_scroll manifest_parser · 90%
info
Tool: cloak_wait manifest_parser · 90%
info
Tool: cloak_evaluate manifest_parser · 90%
info
Tool: cloak_new_page manifest_parser · 90%
info
Tool: cloak_list_pages manifest_parser · 90%
info
Tool: cloak_close_page manifest_parser · 90%
info
Tool: cloak_network_intercept manifest_parser · 90%
info
Tool: cloak_network_continue manifest_parser · 90%
info
Tool: cloak_get_cookies manifest_parser · 90%
info
Tool: cloak_set_cookies manifest_parser · 90%
info
Tool: cloak_pdf manifest_parser · 90%
info
Tool: cloak_console manifest_parser · 90%
info
Tool: cloak_downloads manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (3) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
low
Permission: filesystem access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'cloak_close': Directive language: 'always' poisoning · 85%
critical
Tool poisoning in 'cloak_snapshot': Cross-tool sequencing directive poisoning · 85%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%