---
title: Owl Browser FAQ - Frequently Asked Questions
description: Detailed answers on anti-detection, proxy routing, licensing, self-hosted deployment, and MCP integration.
canonical: https://owlbrowser.net/faq/
last_updated: 2026-09-02
---

# Frequently Asked Questions

## Access & Availability
### Why is Owl Browser access selectively managed?
Owl Browser is an enterprise-grade AI automation browser with source-level anti-detection capabilities built directly into Chromium. We maintain managed access for several key reasons:
Protecting proprietary IP - Our 27 C++ override modules and 31 Blink patches represent extensive core engineering. Controlled access protects these stealth mechanisms from automated scraping and bot-detection reverse engineering.
Preventing malicious misuse - We vet accounts to ensure usage strictly aligns with legitimate web automation, market research, AI data collection, and software testing.
Preserving fingerprint longevity - Controlled distribution ensures our C++ fingerprint virtualization signatures remain pristine and undetected by Cloudflare, DataDome, and Akamai.
Enterprise SLA support - We provide dedicated engineering assistance to teams deploying self-hosted instances at scale.
Developers can sign up for a 14-day $0.99 trial instantly at [portal.owlbrowser.net](https://portal.owlbrowser.net/).

### Is there a confidentiality agreement for self-hosted deployments?
Developer & Trial Accounts: Instant self-service sign-up is available online. Usage is governed by our standard [Terms of Service](https://owlbrowser.net/terms/).
Enterprise & Dedicated Deployments: A standard non-disclosure agreement (NDA) and license agreement are included during onboarding. This protects your proprietary workflow scripts, proxy routes, and business logic while ensuring our underlying C++ patch architecture remains confidential.

### How do I get started with a trial or self-hosted plan?
Getting started takes only a few minutes:
Self-Service Trial: Visit [portal.owlbrowser.net](https://portal.owlbrowser.net/) to start a 14-day $0.99 developer trial with full access to all 185 automation tools.
Self-Hosted Docker: Pull our official container image and launch your instance using your license key token.
Enterprise Sales: Contact [hello@owlbrowser.net](mailto:hello@owlbrowser.net) or complete our [contact form](/#contact) for custom seat allocations, high-concurrency clusters, or SLA support.

### What is your responsible use policy?
Owl Browser is engineered exclusively for authorized business automation. Users must comply with our responsible use standards:
Strict compliance with local, federal, and international laws
Adherence to computer authorization standards and target system rules
Absolute prohibition of credential stuffing, fraudulent transactions, or harmful activities
Immediate revocation of license keys upon policy violation
Review our complete [Terms of Service](https://owlbrowser.net/terms/) and [Security Policy](https://owlbrowser.net/security/) for details.

## Getting Started & Architecture
### What is Owl Browser?
Owl Browser is a high-performance browser engine built on a custom Chromium/CEF release. Unlike conventional automation drivers (Playwright or Puppeteer) that attempt to patch JavaScript at runtime, Owl Browser integrates 27 C++ override modules and 31 Chromium Blink patches directly into the renderer source code.
Core Architectural Highlights:
C++ Source-Level Stealth: Canvas, WebGL, WebRTC, audio, and font fingerprints originate from genuine C++ Blink code paths.
185 Automation Tools: Comprehensive toolset for navigation, DOM interaction, network manipulation, profile state management, and media streaming.
OwlMark Agent Rendering: Compact, token-efficient DOM serialization designed specifically for LLM context windows.
Local Vision AI: Built-in local `llama.cpp` model for zero-latency, zero-cost CAPTCHA solving.
Multi-Protocol Interfaces: REST API, Python SDK, Node.js SDK, WebSockets, and native Model Context Protocol (MCP) server.

### How do I install and run Owl Browser via Docker?
Owl Browser is distributed as an optimized Docker container supporting x86_64 and ARM64 (Apple Silicon / AWS Graviton) architectures:
```
# Pull the container image
docker pull olibai/owl-browser:latest

# Run the container with required environment variables
docker run -d \\
-p 8080:8080 \\
-p 80:80 \\
-e OWL_HTTP_TOKEN=your-secure-api-token \\
-e OWL_PANEL_PASSWORD=your-panel-password \\
olibai/owl-browser:latest
```
Container Services Included:
Chromium/CEF Engine with C++ stealth patches
REST API & WebSocket Server (Port 8080)
React Control Panel via Nginx (Port 80)
Built-in Tor SOCKS5h Proxy Controller (Port 9050)
Local llama.cpp Vision LLM Runtime

### How do I start using the Python or Node.js SDKs?
Python SDK (Python 3.12+):
```
pip install owl-browser
```
```
from owl_browser import OwlBrowser, RemoteConfig

# api_prefix="" talks to the http-server directly; keep "/api" behind nginx
config = RemoteConfig(url="http://localhost:8080", token="your-token", api_prefix="")

async with OwlBrowser(config) as browser:
context_id = await browser.create_context()
await browser.navigate(context_id=context_id, url="https://example.com")
page_info = await browser.get_page_info(context_id=context_id)
print("Page Title:", page_info["title"])
await browser.close_context(context_id=context_id)
```
Node.js / TypeScript SDK (Node 18+, ESM only):
```
npm install @olib-ai/owl-browser-sdk
```
```
import { OwlBrowser } from '@olib-ai/owl-browser-sdk';

const browser = new OwlBrowser({ url: 'http://localhost:8080', token: 'your-token', apiPrefix: '' });
await browser.connect();

const contextId = await browser.createContext();
await browser.navigate({ context_id: contextId, url: 'https://example.com' });
const info = await browser.getPageInfo({ context_id: contextId });
console.log('Title:', info.title);

await browser.closeContext({ context_id: contextId });
await browser.close();
```
Both SDKs build one method per tool from an OpenAPI schema bundled inside the package, so introspection works offline and
nothing is fetched from the server at construction time. Tool parameters keep the server's snake_case names in both
languages; only Node client config fields are camelCase.

### How do I run a task that takes longer than the request timeout?
An agentic run (`browser_nla`) routinely takes minutes and will blow past the 30 second request timeout, dropping the
connection while the browser keeps working. Submit it as a background job instead. `run_task` / `runTask` is the one-call
path: it submits the job, polls it, and returns the unwrapped answer.
```
# Python: timeout and poll_interval are in seconds
answer = await browser.run_task(context_id, "Find the cheapest book and report its price")
```
```
// Node: timeoutMs and pollIntervalMs are in milliseconds
const answer = await browser.runTask({ contextId, command: 'Find the cheapest book and report its price' });
```
For direct control of the job use `submit_job` / `get_job` / `list_jobs` / `cancel_job` / `wait_for_job` and the Node
camelCase equivalents. Job states are `queued`, `running`, `done`, `failed`, `cancelled`, and `cancelling` for a running
job that has been asked to stop. Cancellation cannot interrupt an in-flight browser call, so keep polling through
`cancelling`, it is not terminal.
Jobs are plain REST endpoints and exist on the HTTP transport only. A client built with the WebSocket transport raises a
clear error. Jobs live in server memory and do not survive a restart.

### What are the system requirements for self-hosting?
Hardware Requirements:
Minimum: 2 vCPU, 4GB RAM, 5GB disk space.
Recommended: 8+ vCPU, 16GB+ RAM (supports up to 256 parallel browser contexts per server).
Architectures: x86_64 or ARM64 (macOS M-series, Linux, AWS Graviton).
Network & Ports:
Port 8080: REST API & WebSockets
Port 80: Web Control Panel

## Stealth & Anti-Detection
### Why is C++ source-level spoofing superior to JavaScript stealth patches?
Traditional anti-detect tools use JavaScript injections (such as `puppeteer-extra-plugin-stealth` or `Page.addInitScript`) to override `navigator.webdriver`, `HTMLCanvasElement.prototype.toDataURL`, or `WebGLRenderingContext.getParameter`. Modern anti-bot solutions (Cloudflare Bot Management, DataDome, Akamai, PerimeterX) detect these JS modifications through prototype chain analysis, `Function.prototype.toString` checks, getter inspection, and timing analysis.
Owl Browser eliminates JS overrides entirely. Fingerprint spoofing is compiled directly into the C++ renderer source code across 27 override modules and 31 Blink patches. Because values originate from the standard Chromium C++ functions, they produce 100% native prototype chains, exact `toString()` representations, and identical execution timings that pass `fingerprint.com` and enterprise bot defenses effortlessly.

### Which bot detection systems does Owl Browser pass?
Owl Browser passes all major commercial and proprietary bot detection systems:
Cloudflare Turnstile & Bot Management (Score 0.99)
DataDome Fingerprint & Behavioral Check
Akamai Bot Manager & Sensor Data
PerimeterX / HUMAN Security
Kasada, Imperva Incapsula, and Shape Security
FingerprintJS / Fingerprint.com Pro
Test your configuration anytime using our built-in detection test tool or by navigating to [bot.sannysoft.com](https://bot.sannysoft.com) or [browserscan.net](https://browserscan.net).

### How does human-like behavioral simulation work?
In addition to static fingerprint spoofing, Owl Browser simulates natural human interaction dynamics:
Curved Mouse Trajectories: Bézier curve movements with natural acceleration, deceleration, micro-jitters, and overshoot.
Keystroke Dynamics: Realistic typing speeds with Gaussian inter-key delays and occasional typo corrections.
Natural Scrolling: Smooth inertial scrolling with realistic pause intervals.

## Proxies, Tor & Owl Sidecar
### Does Owl Browser provide or sell proxies?
No. Owl Browser is a browser automation engine and is not a proxy provider. We do not operate a proxy network, sell proxy bandwidth, or sell IP addresses. The privacy routing features built into Owl Browser use infrastructure you already control or the open Tor network.
Learn more in our [Proxy & Privacy Routing Guide](https://owlbrowser.net/proxy/).

### Can I use custom proxies with Owl Browser?
Yes. Owl Browser supports standard HTTP, HTTPS, SOCKS4, SOCKS5, and SOCKS5h (remote DNS resolution) proxies. Proxy parameters can be set per context during context creation or dynamically updated on active contexts:
```
const contextId = await browser.createContext({
proxy_type: 'socks5h',
proxy_host: 'proxy.example.com',
proxy_port: 1080,
proxy_username: 'my_user',
proxy_password: 'my_password',
proxy_spoof_timezone: true
});
```

### How does Tor circuit isolation work?
Owl Browser includes a built-in Tor controller. When setting `is_tor: true` (or `proxy_type: "socks5h"` pointing to local port `9050`), each isolated browser context automatically receives a separate Tor circuit with a distinct exit node IP address. Closing a context tears down its circuit without leaving shared connection state.

### What is Owl Sidecar and how does it work?
Owl Sidecar is a free companion app that turns a device you already own (a home machine, VPS, or server you control) into a private exit node for Owl Browser.
When installed and paired to your account, traffic routes directly from your browser to your sidecar device via peer-to-peer connection. Your data never passes through Olib servers, and the connection forwards raw bytes to preserve the browser's native TLS fingerprint.
```
const contextId = await browser.createContext({
proxy_type: 'owl_tunnel',
proxy_id: 'proxy-my-home-node'
});
```
See the full setup instructions in our [Proxy & Privacy Routing Guide](https://owlbrowser.net/proxy/).

## AI Vision & OwlMark Agent Rendering
### How does the on-device AI vision model solve CAPTCHAs?
Owl Browser bundles an optimized local `llama.cpp` vision LLM runtime. When `browser_solve_captcha` or `browser_solve_image_captcha` is invoked, the browser captures the element canvas in memory and evaluates it directly on-device with zero external API latency or third-party data leakage:
```
// Auto-detect and solve any CAPTCHA challenge on the page
const result = await browser.solveCaptcha({ context_id: contextId });
console.log('Solved:', result.success);
```
External vision models (OpenAI GPT-4o, Claude 3.5 Sonnet, or custom Ollama instances) can also be configured if preferred.

### What is OwlMark and why is it built for AI agents?
Standard web pages contain massive DOM trees, scripts, and styling overhead that quickly overwhelm LLM token limits. OwlMark (`browser_observe`) serializes the accessible DOM into a compact, handle-addressable structured representation specifically optimized for AI agent consumption.
Instead of sending 100,000 raw HTML tokens, OwlMark reduces the page to essential interactive handles (e.g. `@e12`, `@e15`), allowing agents to issue high-precision actions (`browser_click`, `browser_type`) with up to 90% fewer tokens and significantly lower API costs.

## MCP & Agent Integration
### Does Owl Browser support Model Context Protocol (MCP)?
Yes! Every Owl Browser instance comes with a built-in HTTP transporter MCP server (Streamable HTTP / SSE transport on port 8080) authenticated via Bearer Token (`OWL_HTTP_TOKEN`) or OAuth. Additionally, we provide the `@olib-ai/owl-browser-mcp` npm package for local stdio MCP client integrations (such as Google Antigravity, Claude Desktop, Cursor, or LangChain).
1. Native HTTP / SSE Transporter (Built-in):
```
// Connect directly over HTTP / SSE transport with Bearer token or OAuth
{
"mcpServers": {
"owl-browser": {
"url": "http://localhost:8080/mcp",
"headers": {
"Authorization": "Bearer your-secret-token"
}
}
}
}
```
2. Stdio Adapter Package (@olib-ai/owl-browser-mcp):
```
// Stdio configuration for local MCP clients
{
"mcpServers": {
"owl-browser-stdio": {
"command": "npx",
"args": ["-y", "@olib-ai/owl-browser-mcp"],
"env": {
"OWL_BROWSER_URL": "http://localhost:8080",
"OWL_HTTP_TOKEN": "your-secret-token"
}
}
}
}
```
This empowers AI agents to autonomously navigate stealth web pages, extract structured JSON data, solve CAPTCHAs, and manage browser contexts out of the box.

### How do authentication and transport modes work for MCP in Owl Browser?
Owl Browser provides dual transport flexibility for AI agent integrations:
Built-in HTTP / SSE Transporter: Each browser instance exposes a native Streamable HTTP MCP endpoint directly on port 8080. Securable via static Bearer tokens (`OWL_HTTP_TOKEN`) or OAuth2 token headers for remote agent clusters.
Stdio Adapter: The `@olib-ai/owl-browser-mcp` CLI tool wraps stdio input/output streams and proxies requests to the REST API, ideal for local desktop agent workflows.

### Can I integrate external LLMs with Owl Browser?
Yes. You can pass LLM parameters directly when creating a browser context to enable automated semantic page analysis:
```
const contextId = await browser.createContext({
llm_enabled: true,
llm_use_builtin: false,
llm_endpoint: 'https://api.openai.com/v1',
llm_model: 'gpt-4o',
llm_api_key: process.env.OPENAI_API_KEY
});

const answer = await browser.queryPage({
context_id: contextId,
query: 'Extract all pricing tiers and features into JSON format'
});
```

## Web Bot Auth & Signed Agents
### What is Web Bot Auth (RFC 9421) and Signed Agent mode?
Web Bot Auth (RFC 9421) is an IETF standard that allows legitimate AI agent browsers to sign HTTP requests using cryptographic Ed25519 signatures. Enrolling in programs like Cloudflare Signed Agents allows web application firewalls (WAFs) to recognize your AI agent as a verified identity and allow traffic without CAPTCHAs or IP blocks.

### How do Stealth Mode and Signed Agent Mode differ?
Owl Browser supports two distinct operational modes based on your workflow target:
Stealth Mode (Default): Masks automation flags completely, presenting genuine Chrome C++ fingerprints and realistic User-Agents to appear as a human user.
Signed Agent Mode: Identifies the request transparently as `OwlBrowser/1.3` and attaches HTTP Message Signatures so WAFs can verify your public key via `.well-known/http-message-signatures-directory`.

### How do I enable Web Bot Auth in the Docker container?
Configure WBA environment variables when starting the container:
```
docker run -d \\
-e OWL_WBA_ENABLED=true \\
-e OWL_WBA_DOMAIN=https://your-agent-domain.com \\
-e OWL_WBA_CONTACTS=mailto:ops@your-agent-domain.com \\
-p 8080:8080 \\
olibai/owl-browser:latest
```

## Licensing, Pricing & Security
### What are the pricing plans and seat limits?
Owl Browser offers simple pricing tiers for cloud evaluation and self-hosted infrastructure:
Developer ($49.99/mo): Cloud Browser-as-a-Service for evaluation and testing. Includes 1 seat (device), 5 active contexts, 3 VM profiles, and all 185 automation tools. Start with a 14-day trial for $0.99.
Starter ($1,999/mo): Self-hosted deployment for growing teams. Includes 3 seats (devices), unlimited active contexts, unlimited VM profiles, built-in AI vision model, session recording, and SOC 2 aligned controls. Olib is not SOC 2 certified.
Business ($19,999 one-time + $3,999/mo support): Priority support with dedicated onboarding. Includes 10 seats (devices), 3 custom website integrations, priority support (24h response), dedicated account manager, and 99.9% Uptime SLA.
Enterprise ($49,999 one-time + $9,999/mo support): Maximum scale with 50 seats (devices), white-label option, 10 custom website integrations, SOC2 & Security review, and 24/7 phone & chat support.

### How does machine binding and license key activation work?
When starting Owl Browser, submit your license key via the React control panel, REST API (`browser_add_license`), or SDK. The browser validates the license seat securely. To transfer a seat to a new server, deactivate the old instance in the portal or call `browser_remove_license`.

### What security controls are built into Owl Browser?
Owl Browser incorporates security controls aligned with SOC 2 criteria. Olib is not SOC 2 certified and has no SOC 2 attestation report:
AES-256-GCM: Encrypted storage for profile cookies and session states.
Memory Locking (mlock): Prevents sensitive credentials from swapping to disk.
Non-Root Containers: Runs under unprivileged user contexts with dropped Linux capabilities.
HMAC Signed Audit Logs: Tamper-evident logging for enterprise audit compliance.
Read our [Technical Disclosure](https://owlbrowser.net/technical/), [Security Program](https://owlbrowser.net/security/), and [Privacy Policy](https://owlbrowser.net/privacy/).