We rebuilt Chrome from scratch.
For agents, not humans.
Every browser today was designed for people clicking buttons. We ripped out the parts agents don't need and rebuilt the rest in C++ — 18 Chromium patches, a custom CDP domain invisible to every anti-bot system on the internet, and a page understanding engine that tells your agent exactly what every element does before it touches anything. No JavaScript injection. No DOM polling. No detection. Just a browser that sees the web the way an agent should.
#1 on Browser Arena
Head-to-head against BrowserBase, Anchor, and Kernel on real websites with real anti-bot protection. TinyFish dominates every metric.
| Provider | Page Load | Win Rate | Data Transfer | Cost/Run |
|---|---|---|---|---|
| ★ TinyFish | 1,461ms | 95% | 7.7 KB | 0.007¢ |
| Kernel | 3,703ms | — | 163 KB | 0.082¢ |
| Anchor | 5,898ms | — | 428 KB | 2.80¢ |
| BrowserBase | 13,458ms | — | 1,117 KB | 4.65¢ |
Browser Arena runs identical tasks on real websites with production anti-bot protection. Each provider gets the same URLs, same actions, same success criteria. TinyFish's custom C++ browser delivers 9× faster page loads at a fraction of the cost.
Why Build a Custom Browser?
Standard automation tools inject JavaScript, subscribe to CDP events, and poll the DOM. Every one of those operations is a detection vector and a performance penalty. We eliminated all of them.
100% C++ Custom Logic
Every Agent.* command runs in Blink's C++ rendering engine. No eval(), no injected scripts, no MutationObservers. The page's JS context is never touched — invisible to anti-bot detection AND faster because there's no JS-to-C++ bridge overhead.
Single Call = Full Page
One Agent.extractABox call returns everything: all interactive elements (50+ fields each), page structure, scroll info, blocking overlays, content markdown. Standard tools need 10-50 separate DOM queries. One round-trip vs many.
Native Settle Detection
Blink-level probes monitor DOM mutations, network requests, and microtask queues. No setTimeout polling. No arbitrary 2-second waits. The browser itself tells you when the page is done reacting. Average settle: 200-400ms instead of 2000-5000ms fixed waits.
Core Capabilities
Custom Agent.* CDP domain is invisible to anti-bot systems. 28 fingerprint mechanisms hardened at the C++ level. Passes DataDome, Akamai, and PerimeterX on production sites including Expedia, American Airlines, and BrowserScan.
ABox extraction returns 50+ fields per element including action types, settle hints, fingerprints, and interaction modes. Know what an element does — form submit, trigger API, open datepicker — before touching it. No DOM queries needed.
Codification system learns site patterns, builds state machines from observed page transitions, and replays workflows with 3-layer element resolution. Fingerprint match first, behavioral verification second, LLM fallback third. Gets better with every visit.
Architecture Flow
Every agent command flows through a clean pipeline. No event subscriptions, no long-lived connections — pull-based request/response all the way down.
Key Metrics
Detection Test Results
| Site | Protection | Result |
|---|---|---|
| Expedia | DataDome | 5/5 pass |
| AA.com | Akamai | 100% (112 actions) |
| BrowserScan | Bot detection suite | "Normal" |
| SannySoft | Headless detection tests | All passed |
| TLS JA4 | Fingerprint analysis | Matches real Chrome |
Standard CDP vs Agent.* Domain
| Standard CDP (Detected) | Agent.* Domain (Invisible) | ||
|---|---|---|---|
Page.navigate | Agent.navigate | ||
Runtime.evaluate | Agent.extractABox | ||
DOM.querySelector | (not needed — ABox returns all) | ||
Network.enable | (no subscription needed) | ||
Page.enable | (no events, pull-based) | ||
Input.dispatchMouseEvent | Agent.click | ||
Input.dispatchKeyEvent | Agent.type |
Standard CDP domains are detection vectors — anti-bot systems check for CDP usage via JavaScript timing, object presence, and protocol events. The Agent.* domain operates entirely at the C++ level, never exposing itself to page JavaScript. The only standard CDP call allowed is Page.captureScreenshot (one-shot, no Page.enable needed).
5-Layer Stealth Stack
Detection evasion is not a single trick — it is five concentric layers, each handling a different class of detection signal. A failure at any layer exposes the agent.
Human-like timing, variable delays, mouse jitter, realistic viewport sizes
C++ HttpAuthController for proxy, 49K domain filter, WebRTC IP leak prevention
Agent.* domain only. No Page.enable, Network.enable, or Runtime.evaluate
window.chrome shimmed, navigator.webdriver removed, plugins array populated
Canvas noise, WebGL params, font enumeration, AudioContext, ClientRects
Design Philosophy
Observe First, Act Second
Every interaction starts with ABox extraction. The agent sees all interactive elements, their types, predicted behaviors, and settle times before taking any action. No blind clicking, no querySelector guessing.
Pull-Based, Not Event-Based
No event subscriptions, no Page.enable, no Network.enable. Every CDP call is one-shot: request data, get response. This eliminates the protocol-level fingerprint that anti-bot systems use to detect automation.
C++ All The Way Down
Agent.* commands execute in Blink's C++ layer, not via JavaScript injection. No Runtime.evaluate, no injected scripts, no MutationObservers. The page's JavaScript context is never modified.
Settle-Aware Actions
Actions don't just fire and return. They wait for the page to settle — DOM mutations stop, network quiets, microtasks drain. The agent gets the post-action state, not a half-loaded page.
Active Projects
Current engineering focus areas and their status.
Reducing average settle time, improving DOM mutation probe accuracy, and adding network-quiet heuristics for SPAs.
Extending element classification with deeper V8 source scanning, shadow DOM support, and iframe traversal.
28 stealth mechanisms across 5 layers. Passing DataDome, Akamai, PerimeterX, BrowserScan, and SannySoft.
Dynamic proxy switching per-request via content_shell. JIT proxy resolution with geo-targeting and rotation pools.
ABox extraction optimization, memory pool tuning, session pre-warming, and binary size reduction.
Multi-instance gateway, session migration, load balancing across Chrome instances, and health monitoring.