Fortress

Contents

Quick start · Every session a distinct machine · The Fortress MCP · Works with your stack · Why patch the engine · How Fortress compares · Results · Configure the persona · Build & verify · Reference

Quick start

pip install tilion-fortress                       # or: npm install tilion-fortressdocker run --rm -p 9222:9222 tilion/fortress:latest   # any OS, raw CDP on :9222

from tilion_fortress import Fortressfrom playwright.sync_api import sync_playwright
with Fortress() as f:                       # launches the engine on a CDP endpoint    with sync_playwright() as p:        browser = p.chromium.connect_over_cdp(f.cdp_url)        page = browser.new_page()        page.goto("https://bot.sannysoft.com")

import { Fortress } from "tilion-fortress";import { chromium } from "playwright";
const f = await Fortress.launch();const browser = await chromium.connectOverCDP(f.cdpUrl);const page = await browser.newPage();await page.goto("https://browserscan.net");

The pip and npm SDKs download a prebuilt, SHA-256-verified binary (Linux x64, Windows x64). Portable tarballs, a .deb and the Windows .zip are on Releases.

Free for developers

v3 is free for developers, with no machine, session or concurrency caps. Activate once:

tilion activate      # sign in with GitHub, Google or email; key saved to ~/.tilion/license.jwt

The key is checked offline and Fortress never reports usage. Without activation it still runs, on the public first-generation engine. For CI, Docker and agents, set TILION_LICENSE_KEY=<key> or run tilion activate --token <key>; one key covers a fleet. Production keys for larger organizations are at fortress.tilion.com/pricing.

Platforms

_{The arm64, x86 and armhf builds ship without the bundled Widevine CDM.}

Set it up with an AI assistant

[Ask ChatGPT] [Ask Claude] [Ask Gemini] [Copy for agent]

Every session a distinct machine

[Twelve identical browser windows, tagged same machine times twelve, turn one by one into twelve different machines, each with its own screen and clock.]

Each launch mints a fresh, internally coherent machine: GPU, screen, cores, timezone, language and fonts all agree. The persona reaches the renderer over IPC, so nothing shows on the command line and every BrowserContext can hold its own identity. Across 40 back-to-back launches of the same binary:

_{Reproduce with tools/gauntlet.py --runs 40. A 64-clone fleet resumed from one snapshot comes up 48/48 distinct, because on_restore re-keys the whole persona with no relaunch.}

The Fortress MCP

A Model Context Protocol server that gives Claude, Codex, Cursor, Windsurf, Cline or any MCP client a stealth browser as 29 tools, local and free. When a plain fetch is blocked, the agent calls a tool and gets the page.

[Requests from coding agents hit a verify-you-are-human check and are blocked, then route through Fortress, pass the check and reach the website.]

pip install "tilion[mcp]"                  # or zero-install: npx -y tilion-mcpclaude mcp add fortress -- tilion-mcp      # Claude Code

For Claude Desktop, Cursor (~/.cursor/mcp.json), Cline and Windsurf, add the same block to the client's MCP config:

{ "mcpServers": { "fortress": { "command": "tilion-mcp" } } }

The full tool reference, benchmarks and agent skill are in mcp/.

Works with your stack

[A Playwright script where one line changes from p.chromium.launch() to p.chromium.connect_over_cdp on localhost:9222. The rest of the script stays the same.]

With Fortress running (Docker or the tilion command), one line changes: launch() becomes connect_over_cdp("http://localhost:9222").

Why patch the engine, not the page

A JavaScript stealth patch is a function standing where a native one belongs, and detectors check for exactly that:

Realm re-acquisition defeats every main-world patch. A detector takes a pristine primitive from another realm and turns it on your function:

const iframe = document.createElement('iframe'); document.body.appendChild(iframe);const realToString = iframe.contentWindow.Function.prototype.toString;realToString.call(navigator.__lookupGetter__('vendor')); // returns your source code. Caught.

In Fortress the getter for navigator.vendor is the C++ getter. It reports [native code] because it is native code, the same in every frame and worker. Fortress applies the Camoufox idea to V8 and Blink, so the fingerprint matches a Chrome user agent by construction.

The four layers of bot detection

Fortress is the Layer C engine, built to be driven so A and B hold too, and to stay geo-coherent (timezone, locale, WebRTC) once you bring a Layer D IP.

How Fortress compares

_{¹ Multilogin / GoLogin / Dolphin / Nstbrowser: closed-source engine patches, persistent identity by design, bundled residential egress (their Layer-D advantage over Fortress).}

Fortress builds on prior art: fingerprint-chromium, ChromiumFish and CloakBrowser came first, and Camoufox, Multilogin, GoLogin and Dolphin also patch engine C++. Fortress's edge is the combination: the broadest native surface set on a Chromium base, fleet dynamism with on_restore, and parameter-level coherence. Where it is behind: IP egress (bring your own) and behavioral humanization beyond mouse motion.

Results

Benchmark: 92 protected sites, eight stacks

Run on 2026-09-28 from US-East cloud machines, headless, on datacenter IPs with no proxies. Every tool loaded every target twice, each time on a fresh machine destroyed afterwards (1,584 machines). A run counts only if the real page loaded with no challenge or deny page. Method and target list: docs/BENCHMARK.md.

_{95% Wilson intervals; Fortress's does not overlap the next stack's. Fortress got 2/2 on ten sites where neither Camoufox nor puppeteer-stealth got more than 1/2, and there is no site where it got 0/2 while either of them got 2/2. A repeat run the same day scored 85.3%.}

Live detectors

Headless, from a datacenter IP, on the v3 binary. Reproduce with tools/gauntlet.py --bundle ./fortress-v153; dated re-runs are in docs/GAUNTLET_RESULTS.md.

[Fortress clearing a live Cloudflare challenge, then passing sannysoft and BrowserScan]

_{Unedited capture in a real window: Fortress clears a live Cloudflare challenge, turns bot.sannysoft.com all green and reads BrowserScan "Normal".}

Configure the persona

The default is a fresh coherent persona per launch, delivered over IPC. Pin or override any surface with --uxr-* switches:

--uxr-platform / --uxr-ua-platform / --uxr-ua-os / --uxr-ua-arch / --uxr-ua-bitness--uxr-ua-platform-version / --uxr-ua-brand / --uxr-hw-concurrency / --uxr-device-memory--uxr-webgl-vendor / --uxr-webgl-renderer / --uxr-webgl-fullparams / --uxr-webgpu-vendor--uxr-canvas-seed / --uxr-audio-seed / --uxr-timezone / --uxr-languages / --uxr-color-scheme--uxr-screen-width / --uxr-screen-height / --uxr-webrtc-policy=disable_non_proxied_udp

Every flag, env var and coherence rule: docs/UXR_CONFIG.md.

Build & verify

export CHROMIUM_VERSION=$(cat CHROMIUM_VERSION)   # 153.0.8010.36build/build.sh                         # depot_tools, sync the tag, apply patches, gn gen, ninjabuild/rebase-monthly.sh 154.0.XXXX.0   # bump + 3-way apply + rebuild + gauntlet-gate

Output: out/Fortress/chrome. The fork is 81 single-surface patches, and the gauntlet gates every release. The first-generation patch series is public and rebuilds with the same script.

Fortress ships only from these channels:

Every release ships SHA256SUMS (the SDKs check it on install). Verify the Docker image by digest against the release notes:

BASE=https://github.com/tiliondev/fortress/releases/download/v153.0.8010.36curl -LO $BASE/fortress-v153-linux-x64.tar.gzcurl -Ls $BASE/SHA256SUMS | sha256sum -c --ignore-missing     # -> OKdocker inspect --format '{{index .RepoDigests 0}}' tilion/fortress:153.0.8010.36

Reference

patches/     the first-generation C++ patch series (Fortress Source Available License 1.1)build/       args.gn, build.sh, apply-patches.sh, rebase-monthly.sh, windows/, macos/packaging/   tilion launcher, fonts.conf, Dockerfile, .deb + bundle buildersfonts/       222 metric-compatible OS-named font files (154 distinct families, incl. color emoji)sdk/         python + node (tilion-fortress) prebuilt-binary SDKsmcp/         the Fortress MCP server (29 tools) and the agent skilltools/       gauntlet.py, the CreepJS / Sannysoft / BrowserScan CI gatedocs/        UXR_CONFIG (the --uxr-* reference), GAUNTLET_RESULTS, BENCHMARK

Contributing

Fortress does not accept outside pull requests; see CONTRIBUTING.md. Found a detection vector or a leak? Email [email protected] with a reproducible test page.

License

Fortress Source Available License 1.1. Free to read, modify, rebuild and redistribute, and to use for development, testing and evaluation at any size. Production use is free for individuals and for organizations under US$500,000 in cumulative funding and US$300,000 or less in ARR; other organizations need one flat subscription (fortress.tilion.com/pricing, LICENSE, SUBSCRIPTION-TERMS.md). Earlier BSD-licensed releases keep their BSD permissions (LICENSE-BSD-LEGACY). Chromium and the bundled fonts keep their own licenses (NOTICE).