Stealth & Anti-detection

Pry's anti-detection stack is its core competitive moat — a multi-layered system that keeps scrapers looking like real users. The stealth module is licensed under BSL 1.1 (Business Source License): free for personal, non-production, academic, and non-commercial use; a commercial license is required for production use. It converts to MIT on 2029-01-01.

The 10-tier fallback chain

When a request hits POST /v1/ultimate-scrape (or any scrape that enables bypass), Pry walks a fallback chain and returns the first successful result, reporting which method was used.

Tier	Method	Purpose
1	Direct HTTP	Rotating user agents, browser-like headers
2	cloudscraper	Python-native Cloudflare JS challenge solving
3	FlareSolverr	Headless Chrome Cloudflare/WAF bypass (Docker sidecar)
4	undetected-chromedriver	Modified Chrome with no automation flags
5	Playwright	Full browser with human behavior (mouse, scroll, timing)
6	Googlebot UA	Search-engine crawl mimic
7	Tor proxy	Anonymous routing via SOCKS5
8	Archive.org / Wayback Machine	Cached version fallback
9	Google Cache	Cached snapshot
10	Textise	Text-only version

Block detection and adaptive strategy rotation decide when to escalate:

• POST /v1/detect-block — detect the protection vendor (Cloudflare/DataDome/etc.) and confidence
• adaptive.py — rotates strategies automatically based on detected blocking

Stealth engine

stealth_engine.py injects 6 JavaScript scripts into every browser context to hide automation signals:

Script	What it does
webdriver_hide.js	Removes the navigator.webdriver automation flag
canvas_noise.js	Adds tiny noise to canvas fingerprinting
webgl_noise.js	Adds noise to WebGL fingerprinting
audio_noise.js	Adds noise to AudioContext fingerprinting
human_mouse.js	Generates human-like mouse movement paths
human_type.js	Types with human-like speed and errors

Enable/disable via the stealth env vars:

Variable	Default	Meaning
PRY_STEALTH_ENABLED	true	Master switch
PRY_RANDOM_USER_AGENT	true	Rotate user agents
PRY_WEBDRIVER_OVERRIDE	true	Hide navigator.webdriver
PRY_CANVAS_NOISE	true	Canvas fingerprint noise
PRY_WEBRTC_DISABLE	true	Disable WebRTC IP leaks
PRY_GEOLOCATION_SPOOF	true	Spoof geolocation

TLS fingerprint randomization

tls_fingerprint.py randomizes the TLS fingerprint (JA3/JA4) per request. Modern bot detection inspects the TLS handshake, not just headers — a unique fingerprint per request prevents transport-level identification.

Cookie warming

cookie_warmer.py pre-ages cookies so sessions carry realistic trust signals instead of appearing freshly created. Warmed cookie sessions are persisted to disk and listed via GET /v1/cookies/sessions and GET /v1/sessions.

Behavioral biometrics

behavioral_biometrics.py (v2) simulates real human imperfection: hesitation, scroll-back, mouse drift, reading time. Modern anti-bot systems detect "too perfect" behavior, so Pry deliberately adds:

• Bezier-curve mouse paths with random control points
• Speed variation (fast in the middle, slow at endpoints)
• Random delays between actions (PRY_MIN_DELAY_MS / PRY_MAX_DELAY_MS)
• Crypto-grade entropy (random.SystemRandom) so behavior is not predictable

Camoufox integration

For the hardest targets, camoufox_integration.py drives Camoufox — a Firefox fork patched at the source level to defeat fingerprinting. It ships preset browser profiles (e.g. a Windows/Chrome-mimicking config) and falls back gracefully if the camoufox package isn't installed.

Browser pool & pre-warming

browser_pool.py manages Playwright browsers with pre-warming: browser contexts are created ahead of time and kept warm, so each request gets a fresh, fully-initialized browser instantly (no cold-start latency).

Proxy rotation

network.py + webshare_proxy.py provide:

• SOCKS5 proxy support
• Webshare residential proxy pool with rotation (provider tag webshare)
• Tor routing (tier documented, requires the tor compose profile and aiohttp-socks)

Configure via PRY_PROXY_URL, PRY_PROXY_TYPE, WEBSHARE_PROXY_LIST, and PRY_TOR_ENABLED — see Configuration.

License note

The following files are BSL 1.1 (the stealth module):

ultimate_scraper.py, stealth_engine.py, stealth_scripts/*.js,
camoufox_integration.py, tls_fingerprint.py, cookie_warmer.py,
behavioral_biometrics.py, adaptive.py, browser_pool.py, network.py,
captcha_solver.py, shadow_dom.py, lazy_load.py, signup_automator.py,
auth_connector.py

Everything else (core scraping, API, utilities, SDK) is MIT. See Pricing & Monetization for the licensing summary and how to get a commercial license.

Next steps

• x402 Pay-per-call — monetize these capabilities per call
• Troubleshooting — block/Cloudflare issues