Camofox gives agents references instead of raw page markup
A Camofox session opens a Camoufox browser context and exposes each tab through HTTP. The snapshot endpoint returns the accessibility tree with stable references such as e1 and e2. An agent reads that smaller representation, clicks or types against a reference, then takes another snapshot. This is easier to constrain than asking a model to select from a large HTML document on every step.
The server also handles screenshots, files, download capture, page evaluation, link and image extraction, proxy settings, and persisted browser storage. Separate user IDs receive isolated contexts. The default limits allow up to 50 sessions and 10 tabs per session, with idle cleanup settings for tabs and the browser. Those defaults are starting points; a shared service needs resource measurements under its own sites and concurrency.
Anti-detection is an engine feature, not a permission slip
The underlying Camoufox fork changes browser fingerprint surfaces inside Firefox rather than injecting JavaScript shims. Camofox Browser packages that engine for agents and advertises better results against bot detection. We did not measure bypass rates or compare target websites, so this review cannot confirm any universal access claim. Sites change detection rules, and a route that works today can fail tomorrow.
Use it only where the operator is allowed to automate. Authentication cookies, proxy geolocation, and a less obvious fingerprint can increase the impact of a mistake. Build per-site rate limits, stop conditions, and audit logs outside the model prompt. For public data collection at scale, Crawlee may offer the queue controls a REST tab server does not. For browser tests, Playwright is the clearer default.
What happened when we ran it
Our sandbox installed 438 npm packages in 57 seconds and occupied 180 MB. The build completed successfully in 7 seconds. The test command failed after another 7 seconds with exit code 1. We tested commit e5a36f5 in an unprivileged container with 3 CPUs, 8 GB of RAM, no secrets, and Node 22.
Jest failed while normalizing its reporter configuration because it could not resolve the module jest-junit. The supplied log ends in Jest's configuration stack and contains no test count, so there is no basis to say whether any product assertion passed or failed. The result is a repository setup defect in our environment: installation and build worked, while the advertised test command did not reach a reportable suite.
Npm audit found 0 known vulnerabilities across the installed dependency tree. The checkout contained 201 files, about 29,838 source lines, 7 CI workflow files, a Dockerfile, and a tests directory. A normal runtime also needs the Camoufox browser bundle. The README says the standard path downloads about 300 MB, while an external bundle can be selected through CAMOUFOX_EXECUTABLE. Our lab did not launch or benchmark that engine.
Remote access needs a global bearer key
Port 9377 is the default, and Node uses all-interface binding when CAMOFOX_BIND_HOST is unset. CAMOFOX_ACCESS_KEY adds bearer authentication to browser routes, while CAMOFOX_API_KEY separately enables cookie import. A remote deployment should set both as needed, put TLS and network policy in front of the service, and keep /health exposure minimal. Browser control can read pages, use stored sessions, download files, and execute page JavaScript.
Persistence saves cookies and localStorage beneath hashed user directories. IndexedDB capture is optional and can make state larger. Session traces may contain screenshots, DOM snapshots, console output, and network requests; defaults cap each trace at 50 MB and remove files older than 24 hours on startup. Treat profiles and trace zips as credentials and user data, with encrypted storage and short retention.
MCP is a thin adapter over the same REST server
The standalone MCP package exposes 11 tools and translates their calls to the REST API. Claude Code, Codex, Cursor, opencode, and other MCP hosts can spawn one stdio adapter per session while a single Camofox REST server stays running. The adapter can be installed without the browser dependencies when it points at a server on another machine.
That split is sensible, but it does not secure the network hop automatically. A remote CAMOFOX_BASE_URL should use an authenticated, encrypted route, and the adapter needs the same access key as the REST server. Cookie import adds its second key. The MCP README recommends snapshotting before each action, using element references rather than broad CSS selectors, and closing tabs when finished. Those habits reduce ambiguous clicks and leaked sessions.
Crash telemetry is on until an operator changes it
The server sends anonymized crash and hang reports to a Cloudflare Worker by default. Its documentation says private domains are HMAC-hashed, paths and query values are removed, and tokens, IP addresses, emails, and file paths are redacted. The worker may create GitHub issues, which explains the stream of automated memory and event-loop reports in the repository.
Set CAMOFOX_CRASH_REPORT_ENABLED=false when outbound diagnostics are not acceptable, or point the reporter to a self-hosted endpoint. GitHub showed 8,894 stars, 70 combined issues and pull requests, and a last push on August 25, 2026. The latest release is labeled as a Camoufox availability backup rather than a Camofox Browser software release, so current source activity and issue handling are better health signals than that tag.