Skip to main content
Figranium is designed to bypass modern bot detection systems by mimicking human behavior and masking automation fingerprints.

​
Stealth Flags

When creating an Agent task, you can configure the following stealth settings in the Advanced panel:

​
Browser Fingerprinting

Beyond behavioral simulation, Figranium implements several technical anti-detection measures:

User Agent Rotation

Automatically switch between common browser user-agent strings (currently based on Chrome v143).

Viewport Randomization

Vary the browser window size slightly for each execution.

Stealth Plugin

Integrates puppeteer-extra-plugin-stealth to hide Playwright/Chromium-specific properties (e.g., navigator.webdriver).

Proxy Support

Easily route traffic through residential or mobile proxies to mask your IP address.

DNS-over-HTTPS

When no proxy is configured, DNS queries are routed through Cloudflare’s encrypted DoH resolver, preventing DNS-based tracking and leaks.

WebRTC Leak Prevention

WebRTC is configured to disallow non-proxied UDP connections, preventing IP address leaks through WebRTC channels.

​
Browser Engine

Figranium ships two interchangeable browser engines behind the same Playwright API. Every runner — Agent, Headful, and any task launched from the CLI — uses whichever engine is active, so you don’t have to change task definitions when you switch.

​
When to switch to CloakBrowser

Use CloakBrowser when the default stack is being detected on a target site — typically CAPTCHA walls that trigger on Playwright/Chromium runtime tells, or sites that fingerprint the specific patches injected by puppeteer-extra-plugin-stealth. For most workloads the default stack is enough.

​
Enabling CloakBrowser

CloakBrowser is opt-in. Its binary is only downloaded when the flag is enabled, so the default install stays lean.
1

Set the environment flag

Set USE_CLOAK_ENGINE=true in your environment (e.g., .env or docker-compose.yml).
2

Add your license key (optional)

Optionally provide a CLOAKBROWSER_LICENSE_KEY. Without a key, CloakBrowser falls back to the free legacy binary. A key unlocks the latest stealth binary.
3

Restart the server

Restart the server. On next install, scripts/postinstall.js runs npx cloakbrowser install to fetch the binary.
.env
You can also log in interactively instead of setting the env var — npx cloakbrowser login writes the key to ~/.cloakbrowser/license.key, which cloakbrowser reads natively.
The same task JSON, proxies, cookies, viewport, and stealth flags all work identically across both engines. Switch the flag, restart, and rerun.
Every Agent-mode page automatically clicks through common cookie-consent banners so your task can interact with the real page immediately, without you having to author a Click block for every consent dialog you might hit. Figranium injects the community-maintained idcac-playwright ruleset (a Playwright port of the “I don’t care about cookies” browser extension) into every page in the Agent browser context. The script runs on the page’s domcontentloaded event and looks for known consent-banner selectors from OneTrust, Cookiebot, TrustArc, Quantcast, and hundreds of other providers. When it finds one, it clicks the reject or close button — never accept — and lets your task continue.
  • Scope: Agent mode only. Headful and Scrape modes do not dismiss consent banners (Headful is for human interaction; Scrape doesn’t render banners at all because there is no browser).
  • Protocols: Applies to http:// and https:// pages. file:// and data: URLs are skipped by the underlying ruleset.
  • Timing: The click happens after the DOM is parsed but before your first action block runs against the page, so subsequent selectors don’t need to account for the banner overlay.
  • Failure mode: If no matching banner is present, or the ruleset can’t identify a reject button, the script no-ops silently and your task runs as usual. You can still add an explicit Click block if a site’s banner isn’t covered.
There is no configuration flag for this feature — it is always on in Agent mode. If a site’s consent dialog is not being dismissed, capture the banner’s HTML from the headful browser and file an issue with the selector so it can be added upstream.
Stealth features are intended for legitimate automation and testing. Always respect the target site’s Terms of Service and robots.txt. Aggressive scraping may result in IP bans or legal action regardless of evasion techniques used.

​
Best Practices

  1. Enable Human Typing: Always use this for login forms and search bars.
  2. Vary Wait Times: Use the wait action with small random variations instead of fixed durations.
  3. Use Residential Proxies: Essential for scraping sites with aggressive IP-based blocking.
  4. Rotate User Agents: Keep your automation from appearing as a single, static device.