MIT-licensed anti-detect tools

27 entries
Bucket: Permissive
SPDX MIT

MIT is the shortest permissive licence in common use: do what you like, keep the copyright notice and the licence text, and the authors disclaim warranty. It is the most frequent identifier in this catalogue, and its ubiquity is the reason it is worth reading the state column beside it rather than stopping at the licence.

Filed under the SPDX identifier GitHub reports for the repository, not under what the README claims. NOASSERTION means a licence file exists that GitHub could not match to an SPDX identifier — read it before you depend on it.

LicenceMIT

Pushed2026-08-08

Release151.0.7922.47 · 2026-08-06

Stars2.6k

StateACTIVE

Silent6 d

BotBrowser

ACTIVE

Chromium core with a unified fingerprint defence aimed at Cloudflare, Akamai, Kasada, DataDome and PerimeterX.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-08 — 6 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-08
archived	false
latest_release	151.0.7922.47 · 2026-08-06
license.spdx_id	MIT
stargazers_count	2600
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/botswin/BotBrowser

unauthenticated · 60 req/hr

A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON

The vendor list in its README is a claim about vendors, not a measurement of them. This catalogue records that the claim is made; it does not repeat it as a result. — ED.

See also · superseded by · alternatives

LicenceMIT

Pushed2026-08-10

Release—

Stars12.8k

StateACTIVE

Silent4 d

arkenfox/user.js

ACTIVE

The reference hardened Firefox user.js, and the most careful public writing on what resistFingerprinting actually does.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-10 — 4 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-10
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	12800
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/arkenfox/user.js

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed— ¹

Releasechromium-v150…-pro · 2026-08-11

Stars30k

StateACTIVE

Silent3 d

CloakBrowser

ACTIVE

Chromium-based anti-detect browser with a free build and a licence-gated -pro build.

Verify independently — 30k stars since 2026-02-22 is 173 a day, over the 25/day threshold printed in the rubric.

Repository under one year old · Vendor-operated · Licence-key gated build

Source

Evidence

Why ACTIVE: latest_release.published_at = 2026-08-11 (pushed_at not captured; release date stands in) — 3 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	—
archived	false
latest_release	chromium-v150…-pro · 2026-08-11
license.spdx_id	MIT
stargazers_count	30000
created_at	2026-02-22
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/CloakHQ/CloakBrowser

unauthenticated · 60 req/hr

Thirty thousand stars on a repository created 2026-02-22 is 173 stars a day sustained across six months. The release history is genuine and the contributor count is real; the star curve is the part this catalogue will not vouch for. Verify independently before you build a pipeline on it. — ED.

LicenceMIT

Pushed— ¹

Releasev0.1.10 · 2026-06-21

Stars638

StateACTIVE

Silent54 d

ShardBrowser

ACTIVE

Anti-detect browser published by the ProxyShard proxy vendor.

Repository under one year old · Vendor-operated

Source

Evidence

Why ACTIVE: latest_release.published_at = 2026-06-21 (pushed_at not captured; release date stands in) — 54 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	—
archived	false
latest_release	v0.1.10 · 2026-06-21
license.spdx_id	MIT
stargazers_count	638
created_at	2026-05-30
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/ProxyShard/ShardBrowser

unauthenticated · 60 req/hr

LicenceMIT

Pushed2024-07-18

Release—

Stars7.4k

StateNRND

Silent757 d

puppeteer-extra

NRND[NRND]

The classic plugin framework; puppeteer-extra-plugin-stealth lives in this monorepo and is what most tutorials still reach for.

Source

Evidence

Why NRND: pushed_at = 2024-07-18 — 757 days, inside the 365–1095 day NRND band.

Field	Value at this printing
pushed_at	2024-07-18
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	7400
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/berstend/puppeteer-extra

unauthenticated · 60 req/hr

Still the most-copied answer on the internet and two years without a push. That gap is the single best argument for this catalogue existing. — ED.

See also · superseded by · alternatives

LicenceMIT

Pushed2026-08-14

Releasev4.51.12 · 2026-08-10

Stars12.9k

StateACTIVE

Silent0 d

SeleniumBase (UC Mode)

ACTIVE

A test framework whose undetected mode is maintained on the same cadence as the rest of it — which is the unusual part.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-14 — 0 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-14
archived	false
latest_release	v4.51.12 · 2026-08-10
license.spdx_id	MIT
stargazers_count	12900
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/seleniumbase/SeleniumBase

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2026-04-04

Release—

Stars263

StateSEMI

Silent132 d

playwright_stealth (maintained fork)

SEMI

The actively-updated 2.x Python playwright-stealth. The one pip installs is often not this one.

Source

Evidence

Why SEMI: pushed_at = 2026-04-04 — 132 days, inside the 90–365 day SEMI band.

Field	Value at this printing
pushed_at	2026-04-04
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	263
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/Mattwmaster58/playwright_stealth

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2024-07-29

Release—

Stars981

StateNRND

Silent746 d

playwright_stealth (original)

NRND[NRND]

The original Python port. Four times the stars of the maintained fork and two years without a push.

Source

Evidence

Why NRND: pushed_at = 2024-07-29 — 746 days, inside the 365–1095 day NRND band.

Field	Value at this printing
pushed_at	2024-07-29
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	981
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/AtuboDad/playwright_stealth

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2026-07-16

Release—

Stars15.2k

StateACTIVE

Silent29 d

FlareSolverr

ACTIVE

Proxy server that solves Cloudflare's interstitial challenges and hands back the cookies.

Source

Evidence

Why ACTIVE: pushed_at = 2026-07-16 — 29 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-07-16
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	15200
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/FlareSolverr/FlareSolverr

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2026-08-13

Release—

Stars2.5k

StateACTIVE

Silent1 d

CloudflareBypassForScraping

ACTIVE

DrissionPage-based Turnstile bypass, maintained against Cloudflare's changes rather than published once.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-13 — 1 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-13
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	2500
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/sarperavci/CloudflareBypassForScraping

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2024-07-15

Release—

Stars92

StateNRND

Silent760 d

hazetunnel

NRND[NRND]

MITM proxy that injects payloads into passing traffic to mask its non-organic origin.

Source

Evidence

Why NRND: pushed_at = 2024-07-15 — 760 days, inside the 365–1095 day NRND band.

Field	Value at this printing
pushed_at	2024-07-15
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	92
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/daijro/hazetunnel

unauthenticated · 60 req/hr

LicenceMIT

Pushed2026-08-11

Release—

Stars1.6k

StateACTIVE

Silent3 d

ghost-cursor

ACTIVE

Human-like Bézier mouse movement for Puppeteer, still maintained.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-11 — 3 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-11
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	1600
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/Xetera/ghost-cursor

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2024-11-28

Release—

Stars503

StateNRND

Silent624 d

HumanCursor

NRND[NRND]

Human cursor simulation for Selenium and Playwright.

Source

Evidence

Why NRND: pushed_at = 2024-11-28 — 624 days, inside the 365–1095 day NRND band.

Field	Value at this printing
pushed_at	2024-11-28
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	503
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/riflosnake/HumanCursor

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2024-12-03

Release—

Stars288

StateNRND

Silent619 d

Brotector

NRND[NRND]

Open-source anti-bot for webdrivers. Self-host it to test your own evasions against something you can read.

Source

Evidence

Why NRND: pushed_at = 2024-12-03 — 619 days, inside the 365–1095 day NRND band.

Field	Value at this printing
pushed_at	2024-12-03
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	288
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/ttlns/brotector

unauthenticated · 60 req/hr

LicenceMIT

Pushed2026-08-09

Releasev5.2.0 · 2026-04-07

Stars28.3k

StateACTIVE

Silent5 d

FingerprintJS

ACTIVE

The open-source collector, from the company that sells the commercial identifier built on top of it.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-09 — 5 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-09
archived	false
latest_release	v5.2.0 · 2026-04-07
license.spdx_id	MIT
stargazers_count	28300
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/fingerprintjs/fingerprintjs

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed—

Release—

Stars—

StateWITHDRAWN

Silent—

fingerprintjs2 (Valve)

WITHDRAWN[WITHDRAWN]

The v2-era repository. The URL now redirects to the current project, which is the maintainer's own statement about where the work went.

Source

Evidence

Why WITHDRAWN: The URL answered 301 to https://github.com/fingerprintjs/fingerprintjs. The source moved the entry itself.

Field	Value at this printing
pushed_at	—
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	—
http_status	301
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/Valve/fingerprintjs2

Permanent redirect to fingerprintjs/fingerprintjs.

unauthenticated · 60 req/hr

A 301 from the source itself is the strongest liveness field there is: it is the maintainer telling you the entry moved. Nothing here is inferred. — ED.

See also · superseded by · alternatives

LicenceMIT

Pushed2026-08-11

Release—

Stars1.4k

StateACTIVE

Silent3 d

BotD

ACTIVE

Browser-side bot detection library — the same team's answer to the question this whole catalogue circles.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-11 — 3 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-11
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	1400
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/fingerprintjs/BotD

unauthenticated · 60 req/hr

LicenceMIT

Pushed2026-07-17

Releasev1.10.1 · 2026-07-17

Stars1.1k

StateACTIVE

Silent28 d

ThumbmarkJS

ACTIVE

Independent open-source fingerprinting library with a published component breakdown.

Source

Evidence

Why ACTIVE: pushed_at = 2026-07-17 — 28 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-07-17
archived	false
latest_release	v1.10.1 · 2026-07-17
license.spdx_id	MIT
stargazers_count	1100
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/thumbmarkjs/thumbmarkjs

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2026-06-11

Release—

Stars2.5k

StateACTIVE

Silent64 d

CreepJS (source)

ACTIVE

The source behind the test page. Worth reading as a catalogue of lie-detection techniques in itself.

Source

Evidence

Why ACTIVE: pushed_at = 2026-06-11 — 64 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-06-11
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	2500
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/abrahamjuliot/creepjs

unauthenticated · 60 req/hr

LicenceMIT

Pushed2026-08-09

Release—

Stars554

StateACTIVE

Silent5 d

detectIncognito

ACTIVE

Private-browsing detection across engines; a narrow surface maintained properly.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-09 — 5 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-09
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	554
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/Joe12387/detectIncognito

unauthenticated · 60 req/hr

LicenceMIT

Pushed2026-04-25

Release—

Stars602

StateSEMI

Silent111 d

Broprint.js

SEMI

Small canvas- and audio-based visitor identifier.

Source

Evidence

Why SEMI: pushed_at = 2026-04-25 — 111 days, inside the 90–365 day SEMI band.

Field	Value at this printing
pushed_at	2026-04-25
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	602
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/Rajesh-Royal/Broprint.js

unauthenticated · 60 req/hr

LicenceMIT

Pushed2026-08-04

Release—

Stars74

StateACTIVE

Silent10 d

uQUIC

ACTIVE

The same idea for QUIC, which is where this problem is moving.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-04 — 10 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-04
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	74
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/refraction-networking/uquic

unauthenticated · 60 req/hr

LicenceMIT

Pushed2026-08-08

Releasev2.1.0 · 2026-08-08

Stars2.7k

StateACTIVE

Silent6 d

curl-impersonate (lexiforest)

ACTIVE

The maintained fork: curl builds whose TLS and HTTP/2 handshakes match real browsers.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-08 — 6 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-08
archived	false
latest_release	v2.1.0 · 2026-08-08
license.spdx_id	MIT
stargazers_count	2700
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/lexiforest/curl-impersonate

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2024-07-18

Release—

Stars6.8k

StateNRND

Silent757 d

curl-impersonate (lwthiker)

NRND[NRND]

The original. Two and a half times the stars of the maintained fork, and two years without a push.

Source

Evidence

Why NRND: pushed_at = 2024-07-18 — 757 days, inside the 365–1095 day NRND band.

Field	Value at this printing
pushed_at	2024-07-18
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	6800
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/lwthiker/curl-impersonate

unauthenticated · 60 req/hr

The most common single mistake in this whole field: installing the repository with the most stars. Check the push date first — that is all this catalogue is for. — ED.

See also · superseded by · alternatives

LicenceMIT

Pushed2026-08-08

Release—

Stars6.3k

StateACTIVE

Silent6 d

curl_cffi

ACTIVE

Python bindings over curl-impersonate; the usual practical entry point.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-08 — 6 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-08
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	6300
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/lexiforest/curl_cffi

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2026-04-17

Release—

Stars469

StateSEMI

Silent119 d

azuretls-client

SEMI

Go HTTP client with fine-grained control over the handshake and HTTP/2 settings frame.

Source

Evidence

Why SEMI: pushed_at = 2026-04-17 — 119 days, inside the 90–365 day SEMI band.

Field	Value at this printing
pushed_at	2026-04-17
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	469
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/Noooste/azuretls-client

unauthenticated · 60 req/hr

See also · superseded by · alternatives

LicenceMIT

Pushed2026-08-13

Release—

Stars44.7k

StateACTIVE

Silent1 d

mitmproxy

ACTIVE

The general-purpose interception proxy. Not anti-detect tooling, and the fastest way to see what your stack actually sends.

Source

Evidence

Why ACTIVE: pushed_at = 2026-08-13 — 1 days, within the 90-day ACTIVE threshold.

Field	Value at this printing
pushed_at	2026-08-13
archived	false
latest_release	—
license.spdx_id	MIT
stargazers_count	44700
http_status	200
fetched_at	2026-08-14T09:12:00Z
rubric_edition	2nd, in force

Endpoint: GET https://api.github.com/repos/mitmproxy/mitmproxy

unauthenticated · 60 req/hr

See also · superseded by · alternatives

What MIT actually obliges you to do

One thing: reproduce the copyright notice and the permission notice in copies and substantial portions of the software. That is the whole of the obligation. There is no copyleft, no source-disclosure requirement, no patent grant stated in the text, and no restriction on commercial use or on combining the code with proprietary work.

The absence of an explicit patent grant is the one clause-level difference worth knowing about between MIT and Apache-2.0, and it is why some organisations prefer the latter for anything they intend to distribute at scale.

Why a permissive licence is not the whole answer

A permissively licensed project that stopped shipping is not a safer dependency than a copyleft one that did not. The licence tells you what you may do with the code; the maintenance state tells you whether anyone will fix it when the browser underneath it changes. Both columns are printed on every row here for exactly that reason.

This register reads the identifier from the repository's own licence metadata at the field check, not from a README badge, and prints it exactly as the API returned it.

Questions about the MIT entries

Licence questions, answered from the field this register reads and from the licence texts themselves. Nothing here is legal advice.

Can I use MIT-licensed anti-detect tools commercially?

The licence text permits commercial use, modification and redistribution provided the copyright and permission notice travel with the code. This register reports the identifier the repository declares and does not give legal advice; read the licence file itself before you rely on it.

What is the difference between MIT and Apache-2.0 here?

Both are permissive and grouped in the same bucket by this register. The practical difference is that Apache-2.0 states an explicit patent grant and a termination clause where MIT is silent on patents, which is why some organisations distinguish between them and this catalogue files them separately.

Does an MIT licence mean the project is maintained?

No, and the two facts are independent. The licence is a grant; the state beside it is derived from dated fields — days since the last push, the latest release, the archived flag and an HTTP check — by the published rubric.

Every row above was chosen by somebody who then had to establish two separate things — whether the code was alive, and whether it was theirs to use. Donut Browser answers the second in its own repository: an open-source anti-detect browser under AGPL-3.0, with the desktop application and the sync server both in that repository, engine-level fingerprint spoofing through the Wayfern Chromium fork rather than injected JavaScript, a local REST API and MCP server on your own machine, zero telemetry, and a pre-launch gate that refuses to start a profile when the proxy's exit geography contradicts the profile's fingerprint. Its own licence row is in this same catalogue, read at the same field check as everything else.

Download Donut Browser

curl -fsSL https://donutbrowser.com/install.sh | sh

macOS · Windows · Linux · Nix. Desktop only. Source, AGPL-3.0 · Its entry · The rubric that judges it · The keepers' disclosure

Other licences: NO LICENCE DECLARED 12 · Apache-2.0 6 · GPL-3.0 5 · NOASSERTION 5 · BSD-3-Clause 4 · MPL-2.0 3 · AGPL-3.0 2 · FLOSS 1 · BSD-4-Clause 1

12 of the registry's repositories declare no licence at all.