Stealth Browser Agent

AI agents need to interact with web pages that block automation. This Actor provides a hosted stealth browser built for sites that run bot detection — send a URL and a natural-language task, and an LLM-driven browser navigates, clicks, types, fills and submits forms, and automates multi-step flows, extracting structured JSON from bot-defended sites.

What this does

• Stealth browsing — anti-detection fingerprinting passes real-world bot detection systems. Pages see a genuine browser, not automation tooling.
• Residential proxy — optional geo-targeted routing through residential IPs. Datacenter IPs are a fingerprint signal; residential routing eliminates that vector.
• LLM-driven interaction — an AI copilot reads screenshots, plans actions, and drives browser tools (click, type, navigate, scroll, select, wait). No automation scripts to write.
• Structured extraction — the agent returns results as JSON. Provide an output schema and the result conforms to it; omit it and the agent returns best-effort JSON.
• Action log + screenshot — every run produces a step-by-step action log and a final screenshot for debugging and audit.

Use cases:

• Extract product data from bot-defended e-commerce pages
• Fill and submit multi-step forms on behalf of an agent workflow
• Navigate paginated catalogs — click through pages, extract across them
• Scrape structured data from JavaScript-heavy SPAs that block HTTP fetchers
• Verify page state after interaction (confirmation pages, submission results)

Why stealth matters

Most browser automation works fine on cooperative sites. But a growing share of the web uses bot detection — fingerprinting browser characteristics, checking IP reputation, analyzing interaction patterns. Standard headless browsers get flagged on first request.

The subtler problem: even when requests succeed, bot-detection systems serve degraded content to suspected bots. Different prices, missing inventory, placeholder text. Your agent extracts data that looks correct but isn't.

This Actor runs a browser with realistic fingerprinting that passes detection systems in production. Pages see a real browser session. When combined with residential proxy routing, the browser's network fingerprint matches its claimed identity — no datacenter IP giving away the automation.

How it compares to alternatives

Approach	Stealth	Interaction	Structured output	Cost model
Headless browser (self-hosted)	None — detected immediately	Full (you write scripts)	Manual extraction	Your infrastructure
Stealth fetch service	Anti-detection	None — page content only	Raw HTML/markdown	Per-page
Browser-as-a-service (no stealth)	None	Full (LLM-driven)	LLM-extracted	Per-step or flat
Stealth Browser Agent	Anti-detection + residential proxy	Full (LLM-driven)	Structured JSON	Per-step

Stealth fetch services return rendered content from defended pages but can't interact — if you need to click a button before the data appears, you're stuck. Browser-as-a-service tools provide LLM-driven interaction but use standard browsers that get fingerprinted on defended sites. This Actor combines both: stealth browsing with LLM-driven interaction and structured extraction.

Input

Field	Type	Required	Default	Description
url	string	Yes	--	Starting URL. The agent navigates here first, then executes the task.
task	string	Yes	--	What to do on the page, in plain language. Can include interaction steps (click, fill, navigate) and extraction goals. The agent plans and executes actions, then returns structured results.
outputSchema	object	No	--	JSON Schema for the desired result shape. When provided, the agent structures its extraction to match. When omitted, returns best-effort JSON.
modelTier	string	No	basic	How much reasoning the agent applies when planning each step. basic handles ordinary navigation, form filling and extraction. premium plans with deeper reasoning for complex, ambiguous or heavily defended multi-step flows, at a higher per-step rate.
maxSteps	integer	No	100	Hard cap on billable steps in one run (1–100); failed steps do not count toward the cap. The primary cost cap is maxTotalChargeUsd — the agent stops when the next step would exceed your budget — so lower maxSteps only if you want a tighter runaway guard than your budget already gives you.
timeoutSeconds	integer	No	270	Budget for the agent's work on the page, starting when the browser is ready. Browser bring-up (typically 10–90 s) does not count against it.
stepTimeoutSeconds	integer	No	45	Per-action stall guard. Protects your budget from a single hung browser action burning maxTotalChargeUsd. A stalled step is logged and the agent tries a different approach.
proxyGeo	string	No	--	ISO 3166-1 alpha-2 country code (e.g. US, DE). Routes through a residential proxy in that country. Leave empty for default routing.
authMode	string	No	none	Set to storageState to run inside an account you own, using a session you export yourself. The Actor never accepts passwords.
storageState	object	No	--	Playwright storageState JSON ({cookies: [...], origins: [...]}) exported from your own logged-in browser. Stored encrypted; never written to the run log, the step transcript, or the dataset. Required when authMode is storageState.
authAttestation	boolean	No	false	Must be true when authMode is set: you confirm the account and site are owned or controlled by you or your organization and that you are authorized to automate them.

Output

Each run produces one dataset record:

retry provides machine-readable guidance derived from errorClass: null on success, later to retry after a short delay, with_changes to correct the input first, or never to avoid repeating the same input.

{
  "url": "https://books.toscrape.com/catalogue/a-light-in-the-attic_1000/index.html",
  "task": "Click the first book, extract its title and price.",
  "status": "completed",
  "result": {
    "title": "A Light in the Attic",
    "price": "£51.77"
  },
  "steps": [
    {"step": 1, "tool": "click_element", "args": {"selector": "article h3 a"}, "success": true},
    {"step": 2, "tool": "get_text", "args": {"selector": ".product_main"}, "success": true}
  ],
  "screenshotUrl": "https://api.apify.com/v2/key-value-stores/abc123/records/screenshot"
}

Field	Type	Description
url	string	Final URL after all navigation and redirects
task	string	Echo of the input task
status	string	completed, failed, timeout, budget_exhausted, or max_steps_reached
result	object	Structured extraction — shaped by outputSchema if provided
resultComplete	boolean	true only when status is completed. When false, result is either empty or a best-effort partial from a capped run — check this before trusting result as a full answer
steps	array	Ordered action log: step number, tool name, arguments, success flag
screenshotUrl	string	Public URL of the final page screenshot
error	string	Error message when status is not completed (null otherwise)
errorClass	string	Machine-routable failure class; null on success

Failure taxonomy: source_error is a temporary target-site problem and is retryable; source_walled is an access challenge and may succeed on retry; budget_exhausted is retryable with a larger budget. no_content, malformed_input, agent_error, and not_covered require changing the page, input, or task rather than retrying unchanged. not_covered means this Actor does not operate on that target, so re-running will not change the answer.

Example

{
  "url": "https://books.toscrape.com",
  "task": "Click the first book, then extract its title, price, and availability. Return JSON with fields title, price, and in_stock.",
  "maxSteps": 10
}

curl:

curl -X POST "https://api.apify.com/v2/acts/shelvick~stealth-browser-agent/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://books.toscrape.com","task":"Click the first book, extract its title and price.","maxSteps":10}'

Python SDK:

from apify_client import ApifyClient

client = ApifyClient("YOUR_TOKEN")
run = client.actor("shelvick/stealth-browser-agent").call(
    run_input={
        "url": "https://books.toscrape.com",
        "task": "Click the first book, extract its title and price.",
        "maxSteps": 10,
    }
)
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["result"])

Calling from an AI agent

Apify MCP server

The Actor is available as a callable tool via mcp.apify.com. The input schema is self-documenting — an LLM can construct correct calls from the tool description and field names alone. Agentic payment is supported via x402 USDC on Base or Skyfire managed tokens.

Apify SDK (Python)

from apify_client import ApifyClient

client = ApifyClient("YOUR_TOKEN")
run = client.actor("shelvick/stealth-browser-agent").call(
    run_input={
        "url": "https://example.com",
        "task": "Extract the main heading and all links on the page.",
    }
)
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["status"], item["result"])

REST API

Synchronous (blocks until complete, returns dataset items directly):

POST https://api.apify.com/v2/acts/shelvick~stealth-browser-agent/run-sync-get-dataset-items?token=YOUR_TOKEN

Asynchronous (starts run, poll for completion):

POST https://api.apify.com/v2/acts/shelvick~stealth-browser-agent/runs?token=YOUR_TOKEN
GET  https://api.apify.com/v2/actor-runs/{runId}/dataset/items?token=YOUR_TOKEN

The synchronous endpoint has a 5-minute cap. For complex tasks that may exceed this, use the async endpoint.

Authenticated runs

By default the agent works on public pages and never signs in. When you need it to work inside an account, hand it a session you exported yourself:

• Set authMode to storageState.
• Paste your exported session into storageState. It is stored encrypted, and never written to the run log, the step transcript, or the dataset.
• Set authAttestation to true to confirm the account and site are yours or your organization's and that you are authorized to automate them.

This Actor never accepts a password. There is no username or password field, and the agent is instructed never to type credentials — if the site shows it logged out, the run ends with an error rather than attempting a login.

Export your session

From a browser you have already logged in with, using Playwright:

context.storage_state(path="session.json")

Then paste the contents of session.json into storageState. A cookie-export browser extension that writes Playwright storageState JSON works the same way. Sessions expire — re-export when a run reports that the session was not accepted.

If a run comes back logged out. Some sites tie a session to the browser that created it, by user agent or IP, and hand any other browser a fresh signed-out session. A session exported from a tool or a script rather than a real browser fails this way most often. Two things help: export from an ordinary browser you logged in with by hand, and re-export shortly before the run. When the site clears the supplied session outright, the run stops before the agent does any work and no steps are charged.

Acceptable use

Authenticated runs are for accounts you own or are authorized to automate. Runs against someone else's account are prohibited.

Some categories are not available for authenticated runs at all. A run that targets one ends immediately with errorClass: not_covered and no step charges:

• Financial — banks, card issuers, brokerages, payment and crypto services.
• Government — government and military sites, and identity portals.
• Healthcare — patient portals and health-record systems.
• Email and account providers — mailbox sign-ins, which are the reset path for every other account you own.
• Sites whose operators pursue automated access through legal action — a named list, kept in the Actor's source.

Public pages on those sites are still reachable with authMode left as none.

We honour access-revocation requests from site operators: a site whose operator asks us not to access it is blocked for every run, in every mode.

This Actor does not solve CAPTCHAs.

Pricing

Charged per step — each browser action (click, type, navigate, extract) counts as one billable step. Two things move the per-step rate:

• Capability tier (modelTier) — basic is the default and the cheaper rate; premium applies deeper reasoning to each planning decision and costs more per step. If you never set modelTier, you stay on the basic rate.
• Proxy routing (proxyGeo) — setting a country routes the browser through a residential proxy, and the higher per-step rate for that covers the residential bandwidth.

That gives four per-step rates: basic and premium, each with and without proxy.

Failed steps (browser errors) and failed planning calls are never charged. Only successful tool executions are billed. The extraction step (when the agent returns its final result) counts as one step.

The primary cost cap is maxTotalChargeUsd — the agent checks the remaining budget before each step and stops if the next step would push spend past your cap. A single hung browser action can't burn the rest of the budget either, thanks to the per-step stall guard (stepTimeoutSeconds). maxSteps caps billable steps at 100 per run on top of those two.

Premium costs meaningfully more per step, so it is worth reaching for when a task is genuinely hard — ambiguous multi-page flows, heavily defended sites, decisions that depend on reading the page carefully — and worth leaving alone when it isn't.

See the Pricing tab on this Store page for the current per-event rates and any active subscriber discounts.

Behavior

Failure modes:

• not_covered — the target is in a category this Actor does not sign into, or its operator has asked us not to access it. No steps are charged.
• failed — the agent could not accomplish the task (page requires authentication, target element not found, page is blank or broken)
• budget_exhausted — maxTotalChargeUsd would be exceeded by the next step. Raise the budget to continue further.
• timeout — the agent-work budget (timeoutSeconds) was reached after browser bring-up. Partial results may be present in result.
• max_steps_reached — the run hit its maxSteps cap (100 by default) before finishing. Raise maxSteps if you lowered it; at 100 the task needs splitting into smaller runs.

Partial results on capped runs. When a run hits maxSteps or maxTotalChargeUsd after collecting data, the agent makes one final synthesis pass over what it already gathered and delivers it in result as an honest partial: fields it has no data for are null, resultComplete is false, and the status keeps the cap value — a partial is never presented as a completed run. The synthesis pass itself is never charged. Use the partial as-is, or re-run with a higher cap for the full answer; the step-by-step transcript is available at stepTranscriptUrl either way.

The error field contains a human-readable explanation on non-completed runs.

Run-level failures (rare): invalid input (missing url or task, malformed outputSchema) causes immediate failure before any steps execute. No steps are charged.

Performance expectations:

• The stealth browser session takes ~30-90 seconds to launch and load the target before the first step runs. Hardened sites take the longest — heavily defended pages can push bring-up toward two minutes.
• Once the browser is ready, steps after that typically run a few seconds each (planning plus the browser action).
• A simple 1-2 step extraction usually completes in about a minute end to end; multi-step interactions and multi-page flows scale up from there.
• Residential proxy routing adds a little latency per navigation.

Telemetry: to improve reliability and coverage, this Actor reports anonymous usage metrics and diagnostic events to the developer — run outcome counts, the target site's hostname, and, only when something goes wrong, the relevant input fields. No account identifiers are collected, and telemetry never affects a run.

FAQ

What if the page requires a login? Leave authMode as none and the agent will not attempt to sign in; if the page redirects to a login wall, the run returns status: failed. To work inside an account you own, supply a session — see Authenticated runs.

Am I charged if the task fails? Steps that completed successfully before the failure are charged. The failing step itself is not. If the run fails before any steps execute (invalid input, unreachable URL), nothing is charged beyond the platform start event.

How do I control costs on complex tasks? Set maxTotalChargeUsd in the run configuration. The agent enforces this as a real bound — it stops before charging a step that would push spend past your cap (status: budget_exhausted). No need to also fiddle with step or time caps for cost control; the budget is the ceiling.

Can I use this for batch scraping? This Actor handles one URL per run. For batch work, start multiple runs in parallel via the API or SDK. Each run is independent with its own browser session.

What this doesn't do

• No password custody. The agent never accepts or types a password. To work inside an account you own, export a session yourself — see Authenticated runs. Accounts you do not own, and the categories named under Acceptable use, are out of bounds.
• No CAPTCHA solving. Sites requiring interactive CAPTCHAs (puzzle, image selection) will fail. Invisible scoring CAPTCHAs (reCAPTCHA v3) are handled by the stealth fingerprint.
• No file downloads. The agent interacts with page content but does not download PDFs, images, or other files.
• No persistent sessions. Each run starts a fresh browser — nothing carries over between runs unless you supply a session via authMode.

For bulk page fetching without interaction (no clicking or form filling), a batch fetcher is more cost-effective. For CAPTCHA-heavy sites requiring human solving, use a CAPTCHA-solving service upstream and pass the unlocked URL to this Actor.

Related Actors

Actor	Use it when
Smart Page Fetcher	you only need page content fetched — no interaction with the page
Structured Data Extractor — URL to JSON	you have the URLs already and just need schema-validated JSON out of them

---