Fortress

Fortress is an open-source Chromium fork built to keep automated browsers from being detected. Rather than patching behavior in JavaScript, the way most stealth tools do, it corrects the browser fingerprint inside Chromium's own C++ so the browser presents as an ordinary Chrome install. It's the flagship project from Tilion, a team whose stated aim is to give AI agents and automation the same access to the open web that a normal person's browser has. The team frames the mission around a simple principle, that every agent works for a person, so whatever a site keeps from an agent it also keeps from the person behind it.

Modern anti-bot systems don't just check a user agent string. They probe dozens of subtle signals, the driver artifacts left by automation frameworks, side-effects of the DevTools protocol, and quirks in how the browser answers fingerprinting questions. A headless browser wired up with the usual JavaScript patches tends to give itself away, because those patches can be spotted by inspecting a function and seeing that it's no longer native code. The result is blocked requests, endless CAPTCHAs, and scrapers that work for a week and then quietly stop. Those signals span three broad layers, the driver artifacts an automation framework leaves behind, the side-effects of speaking the DevTools protocol, and the fingerprint surfaces a page can read directly. Miss any one of them and a modern defense can still spot the difference.

Fortress attacks the problem at the engine level. It ships as a set of single-purpose C++ patches, each fixing one detection vector, so that native getters return native code across every JavaScript context including the main frame, iframes, and workers. Because the correction lives in the binary rather than in a script the page can read, the browser looks ordinary from the inside out. The team keeps the fork rebased on current Chromium on a regular cycle, which matters because a stale browser version is itself a tell. There are 34 of these single-purpose patches in the current tree, and because each targets one vector, the set can be read, audited, extended, or trimmed rather than trusted as an opaque bundle.

Driving it feels familiar. Fortress exposes a raw CDP endpoint on a standard port, so an existing Playwright or Puppeteer script can connect over CDP with no code changes. It's distributed as a pip package, an npm package, and a Docker image, and it offers tunable personas through command-line flags so an operator can present a coherent identity rather than a random mix of signals. Two Chromium bases are available, a stable line meant to blend in with the majority of real users and a newer line for testing. In practice a script connects over CDP to that endpoint and drives the browser exactly as it would a normal one, so moving an existing automation project across is mostly a matter of pointing it at Fortress.

Alongside the browser, Fortress ships an MCP server aimed squarely at AI agents. It exposes a set of tools that an assistant such as Claude or Cursor can call to fetch pages, extract content, and crawl, all through the stealth engine. That turns the project into more than a scraping tool, it becomes a way to give an agent dependable eyes on the web without every other request tripping a block. This is the piece that ties the open web access mission back to day-to-day agent work. The MCP server exposes on the order of two dozen or more tools an assistant can call, which is enough for it to browse, read, extract, and gather from sites that would otherwise turn a bare agent away.

It's built for developers who write scrapers and automation, for teams that want to test their own bot defenses against a realistic browser, and for anyone building agents that keep hitting walls with ordinary headless setups. What sets it apart is where the work happens. Most stealth libraries live in JavaScript and therefore carry their own fingerprint, while Fortress moves the fix into the engine and publishes the patches so you can read exactly what it changes. It also reports passing common detector suites and live Cloudflare challenges. The project points to results against well-known fingerprinting tests and to real retail and travel sites as evidence, and it rebases on current Chromium on a monthly cycle to keep pace.

The engine and its patches are open source under a BSD-3-Clause license, so you can run it, audit it, and rebuild it yourself at no cost, with Chromium keeping its own upstream license. For teams that would rather not manage browser builds, Tilion is preparing a hosted service called Tilion Cloud, which is currently gated behind a waitlist. The team can be reached at team@tilion.dev.