Fortress

Fortress is an open-source Chromium fork that fixes the bot-detection problem at its root: instead of patching the browser fingerprint from JavaScript after the page loads — the approach every ‘stealth’ library before it has taken — Fortress corrects the fingerprint inside Chromium’s own C++, so navigator.vendor, WebGL, canvas, audio, and font surfaces all resolve to real native getters. A page that inspects itself with .toString() or grabs a primitive from a fresh iframe or Web Worker sees stock Chromium, because that’s genuinely what’s running underneath. The result: Playwright and Puppeteer scripts that used to get flagged by Cloudflare, Akamai, DataDome, and CreepJS complete their runs unmodified, connecting to Fortress over the same CDP endpoint they’d point at any other browser.

The engine ships as 34 small, single-purpose patches against upstream Chromium, tracked in patches/ and rebuilt monthly against the latest release. Anyone can read a patch in a few minutes, verify what it changes, and rebuild the entire browser from source with one script (build/build.sh); a gauntlet of live detectors (CreepJS, Sannysoft, BrowserScan, live Cloudflare Turnstile) gates every release so regressions get caught before they ship. Fortress also avoids the CDP-side leaks that give away other automation tools — no Runtime.enable fingerprint, so agents driving it over raw CDP don’t get flagged at that layer either.

Beyond the browser binary, Fortress ships a Model Context Protocol server with 29 tools — fetch_protected_page, extract_page, crawl_site, recon_site_apis, run_browser_task, and more — so any MCP-compatible AI agent (Claude, Cursor, or others) can reach for a stealth browser the moment a fetch gets blocked, without the operator wiring up Playwright themselves. Prebuilt binaries install via pip install tilion-fortress or npm install tilion-fortress (Linux x64 and Windows x64 native, with Docker filling in for macOS and other platforms), and every download is SHA-256 verified against the published release checksums.

Fortress is BSD-3-Clause licensed for the patches, tooling, and MCP server, with no license keys or paid tiers gating anything currently shipped — the same patch series that ships in the binary is the one you can read, audit, and rebuild yourself.

What You Get

• A drop-in stealth Chromium binary that speaks CDP on :9222, so existing Playwright/Puppeteer automation runs unchanged
• 34 auditable C++ patches against upstream Chromium, published in patches/ and rebuildable from source with one script
• A 29-tool MCP server (tilion-mcp) that gives Claude, Cursor, and other MCP clients direct stealth-browsing tools like fetch_protected_page and crawl_site
• Prebuilt native binaries for Linux x64 and Windows x64 via pip/npm, plus a Docker image for any platform, all SHA-256 verified
• A tunable persona system (--uxr-* flags) to override GPU, timezone, language, hardware concurrency, and Client-Hints coherently
• A dated, reproducible detector gauntlet (CreepJS, Sannysoft, BrowserScan, Cloudflare Turnstile) that gates every release

Common Use Cases

• Running existing Playwright/Puppeteer scrapers against Cloudflare-, Akamai-, or DataDome-protected sites without rewriting automation code
• Giving an AI agent a stealth-browsing tool call (via the Fortress MCP) to reach for the moment a fetch returns a 403
• QA teams testing how a site’s own bot-detection stack responds to a fingerprint-coherent, non-headless-flagged browser
• Structured data extraction and site crawling behind anti-bot walls via the extract_page/crawl_site MCP tools
• Auditing or rebuilding a stealth Chromium fork from source instead of trusting a closed-source antidetect-browser vendor binary

Under The Hood

Architecture The system layers cleanly: (1) the Chromium engine patches apply corrections natively across Blink/V8/BoringSSL as 34 single-purpose diffs organized as a numbered patch series against upstream Chromium, applied via build/apply-patches.sh and rebuilt with build/build.sh into out/Fortress/chrome; (2) a packaging layer (packaging/tilion launcher, Dockerfile, .deb builder) wraps the compiled binary with a default persona and font set; (3) two thin client SDKs (sdk/python/tilion_fortress, sdk/node) are pure orchestration — they detect platform, download and SHA-256-verify a prebuilt release asset, spawn the binary or a docker run, and poll /json/version until CDP is up, exposing a single Fortress class with start()/close()/context-manager semantics and zero engine-build code; (4) an independent MCP server (mcp/server.py, built on mcp.server.fastmcp.FastMCP) sits on top of a separate tilion.facade.Tilion class wrapping a lazily-started shared browser behind 29 @mcp.tool-decorated async functions, each wrapped in a _safe() decorator enforcing a wall-clock timeout and returning structured error payloads instead of raising, plus a _check_url SSRF guard blocking localhost/private/metadata addresses. The three layers are cleanly separated, so replacing the underlying persona engine wouldn’t require touching the MCP tool surface — only the facade; CDP is the sole coupling point between the engine and every downstream client, so a change there would ripple through all of them at once.

Tech Stack The engine itself is Chromium (149/151 track) in C++, patched with 34 unified diffs touching base/, content/, and third_party/blink/renderer, built via depot_tools + GN + Ninja. The Python SDK (tilion-fortress on PyPI, Python >=3.8) is stdlib-only — hashlib/urllib.request/subprocess/tarfile/zipfile, no third-party runtime dependencies — and the Node SDK (tilion-fortress on npm, Node >=18) is a small ESM package with a CLI entry point. The MCP server is Python, built on the official mcp.server.fastmcp.FastMCP SDK with async/await throughout and ToolAnnotations marking each tool read/write/destructive, configured entirely through TILION_* environment variables. Docker (tilion/fortress, a stripped single-layer ~302MB image) is the cross-platform fallback for macOS and any platform without a native binary. CI (GitHub Actions) runs a patch-integrity linter, pytest for both the linter and the Python SDK across Python 3.9/3.12, and shellcheck for build scripts — deliberately skipping a full Chromium compile, which is documented as a multi-hour job unsuited to every push.

Code Quality Tests exist at two levels in this checkout: a patch-integrity linter with its own pytest suite, and SDK tests for both the Python and Node packages, all wired into CI across a Python version matrix — though no test suite was found for the MCP server itself in this checkout. Error handling is deliberate: every MCP tool is wrapped in a decorator that enforces a timeout via asyncio.wait_for and converts any exception into a structured error object instead of letting it propagate as an opaque protocol failure, and the SDK raises typed, actionable errors (SHA-256 mismatch, missing launcher, unknown channel) rather than swallowing them silently. Naming is consistent and descriptive, type hints are used throughout the Python code with from __future__ import annotations, and a pre-commit config plus CI enforce whitespace/YAML/JSON checks, the custom patch linter, and shellcheck. No dedicated static type-checking config (mypy/ruff) was found, and the tilion.facade.Tilion module the MCP server depends on lives outside this repo, so its test coverage can’t be verified from this checkout alone.

What Makes It Unique Fortress’s distinguishing choice is correcting the fingerprint inside the compiled engine rather than in a JavaScript shim — the idea Camoufox pioneered on Firefox, applied here to Chromium/V8/Blink, which the project argues matters because a Chromium-based persona is coherent by construction rather than an anomaly the way a Firefox-based stealth browser is at its much smaller market share. The most differentiated piece — a fully coherent, unique persona generated per launch across GPU, timezone, language, hardware, and TLS shape simultaneously, rather than randomizing each surface independently — is explicitly documented as Fortress’s core proprietary technology and is not part of the open patch series; what ships openly today is the 34-patch engine fork plus a --uxr-* flag-based persona override. The published, auditable patch series and reproducible from-source build are still a real differentiator against closed antidetect-browser vendors that ship opaque binaries, even though the underlying detection-evasion concept is prior art the project credits rather than something wholly novel.

Self-Hosting

Licensing Model BSD-3-Clause for the patch series, build tooling, packaging, and MCP server in this repository — everything shipped here runs identically in a self-hosted deployment with no license key or activation step.

Self-Hosting Restrictions None found for what’s in the public repo today. Worth noting: docs/PERSONA_ENGINE.md explicitly states that the next-generation “Persona Engine” — the per-launch, fully coherent identity generator referenced in the README’s v2/MaskConfig roadmap item — is Fortress’s core technology and “not part of the open distribution,” so that specific upcoming capability is not expected to ship in the open repo even though the current --uxr-* flag-based persona override does.

Enterprise Features Not productized yet. The project’s website (tilion.dev) advertises a waitlist for “Tilion Cloud,” a hosted offering with residential egress, but no pricing or feature tiers are published as of this writing.

Cloud vs Self-Hosted Today there is no functional difference — the entire repo runs the same whether self-hosted via binary/Docker or (eventually) via the still-unshipped Tilion Cloud waitlist service.

License Key Required No, not for anything currently shipped.