io.github.koloss777/nokk is an MCP server that headless browser for AI agents with Chrome's fingerprint that passes Cloudflare challenges. Its tool list has not been published yet over stdio and sse, requires no API key, and scores 61/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"nokk": {
"args": [
"nokk-mcp",
"--rotate-fingerprint"
],
"command": "uvx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Headless browser for AI agents with Chrome's fingerprint that passes Cloudflare challenges.
This server supports HTTP transport. Be the first to test it - help the community know if it works.
Five weighted categories - click any category to see the underlying evidence.
No known CVEs.
Checked nokk-mcp against OSV.dev.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in browser / ai-ml
Open-source web scraper for AI agents with scrape, crawl, and map tools
A cross-platform desktop application for managing AI Agents and MCP Servers. 一款用于管理AI智能体与MCP服务器的跨平台桌面应用程序。
Search-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.
An open-source AI agent that brings the power of Gemini directly into your terminal.
MCP Security Weekly
Get CVE alerts and security updates for io.github.koloss777/nokk and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
A stealth headless browser engine in Rust. Passes Cloudflare without Chromium.
Real V8 and a DOM, a Chrome TLS/HTTP fingerprint (JA3/JA4) and JS-level stealth, driven over the Chrome DevTools Protocol: Puppeteer and Playwright connect as usual. Also an MCP server for AI agents.
scrapingcourse.com's Cloudflare test page, one run from a home connection; medians across sites are in the tables below.
The nøkk is a shapeshifting water-spirit of Norse myth that takes on a familiar shape to pass unnoticed. This one takes the shape of Chrome.
pip install nokk # Python: the prebuilt binary is in the wheel
npm install @koloss777/nokk # Node: run it with `npx nokk`
docker run --rm -p 9222:9222 ghcr.io/koloss777/nokk:latest
No browser to download. Prebuilt for Linux (x86_64, ARM64), macOS on Apple Silicon and Windows x64; anything else builds from source.
# Load a page behind Cloudflare, clear the challenge, print what is behind it
nokk --load https://www.scrapingcourse.com/cloudflare-challenge --solve-challenge 30 \
--eval "document.querySelector('h2').textContent.trim()"
# Or run the CDP server and drive it from any client
nokk --port 9222 --auto-solve # ws://127.0.0.1:9222/devtools/browser/nokk
import nokk
from playwright.sync_api import sync_playwright
with nokk.launch(auto_solve=True) as server, sync_playwright() as pw:
page = pw.chromium.connect_over_cdp(server.ws_endpoint).new_page()
page.goto("https://www.scrapingcourse.com/cloudflare-challenge")
print(page.title())
For AI agents, uvx nokk-mcp runs it as an MCP server.
Puppeteer, Node, sessions and the Cloudflare options are below.
Puppeteer and Playwright drive a real Chromium, and anti-bot systems spot it through
navigator.webdriver, CDP artifacts and a headless TLS handshake. nokk is built to
look like Chrome from the TLS handshake to the JavaScript environment, and has no
rendering engine at all.
| nokk 0.1.35 | Chrome 151 (Puppeteer / Playwright) | |
|---|---|---|
| Start until CDP answers | ~0.05 s | ~0.2 s |
| Idle memory (PSS) | ~60 MB, 1 process | ~330 MB, 12–14 processes |
| Cloudflare solve, median wall time | 12.4 s | 12.4 s |
| Slowest solve | 15.6 s | 27.8 s |
| CPU per solve | 6.4 s | 9.5 s |
| Peak memory per solve | ~570 MB | ~720 MB |
| Solved | 24/24 | 24/24 |
| TLS fingerprint (JA3/JA4) | matches Chrome 151 | Chrome |
| Screenshots, PDF, layout | no | yes |
| CDP coverage | the common path | full |
Measured on nokk 0.1.35, an 8-core Linux box, October 2026. Cloudflare row: 8 production sites × 3 runs throug