trueoriginlabs/vibatchium

**The browser layer for an always-on box.** Many logged-in identities, running
unattended, all at once — on real Chrome, with stealth on by default, and with a
security model for letting an AI near the credentials.
One daemon, N persistent Chrome sessions, a vb CLI and an MCP server.
Self-hosted, free, Apache-2.0.
Is this for you?
| You want… | Use |
|---|---|
| An agent driving **your** signed-in browser while you watch | Claude in Chrome, Chrome Auto Browse — first-party, free, better integrated |
| The **stealthiest single browser** you can buy | CloakBrowser — fingerprints patched in Chromium's C++ (paid for concurrency) |
| The **leanest driver** for one agent | bladebro — five tools, one Rust binary |
| Browser automation without anti-bot pressure | playwright-mcp, agent-browser — bigger, older, better tested |
| **Many accounts on one box, running unattended, against sites that fight automation** | **vibatchium** |
That last row is the whole wedge. Supervised agents hand control back to you at
every login wall and CAPTCHA; a library leaves the fleet — sessions, budgets,
crash recovery, credentials — for you to build. vibatchium is that fleet layer.
How it compares
As of 2026-10-06, from each project's own README, source and release notes
(the MCP-cost row is our own measurement¹). Rows where we lose are included on
purpose.
| | **vibatchium** | CloakBrowser | bladebro | agent-browser | playwright-mcp |
|---|---|---|---|---|---|
| N persistent logged-in sessions at once | **yes, free, one daemon** | 1 free (latest build) · more on Pro | one Chrome per agent session | yes, one daemon per session | one per profile dir |
| Unattended ops: crash self-heal, leases, budgets, idle freeze, goals | **all of them** | — | partial (crash relaunch, idle timeout) | partial (idle timeout, restore) | idle timeout |
| Agent can *use* a secret but not *read* it (origin-bound fill, read-back refused, TOTP) | **yes** | — | — | vault, origin check | --secrets redaction |
| Prompt-injection scanning of page content | **yes** | — | — | boundary markers (opt-in), no scanning | — |
| Browserless HTTP on the session's own cookies, Chrome TLS fingerprint · keyless web search | **yes** | — | — | — | — |
| Browser | stock Chrome | own Chromium build | stock Chromium | Chrome for Testing default | stock Chrome |
| Stealth layer | CDP-level (Patchright) | **engine-level (87 C++ patches)** | CDP-level ("6-layer"), no Runtime.enable | none in core; via cloud providers | none |
| Published stealth score | not yet | 30/30 on its own detector list | **68/80 Stealth Bench V1 (self-run)** | — | — |
| MCP startup cost in Claude Code¹ | ~2.7k tokens (87 tools, 5 always loaded) | n/a | ~3.4k tokens (5 tools) | not measured | not measured |
| Platforms | Linux (macOS: CI probe, unsupported) | Linux · macOS · Windows | Linux · macOS · Windows | all | all |
¹ bytes/4 of tools/list plus server instructions, measured over stdio. Clients without tool search load every tool: vb mcp --caps min is 12 tools, ~3.8k tokens. bladebro's own README says ~1.9k.
**Where the others are genuinely better:** CloakBrowser's engine-level patches
go deeper than any CDP-level layer can — and vb start --browser-binary will
drive a Chromium build you bring. bladebro has a stealth benchmark number and we
don't; until we do, read our stealth claims as measured on scoreboards, below,
not on production walls. Both run on more operating systems.
What only vibatchium does
**1. A fleet of logged-in identities on one box.** Each session is its own
Chrome and profile, with its own proxy, timezone and GPU node, and — opt-in
with vb persona set — its own screen and window, because by default every
headless session on one machine reports the same 800×600 screen. vb
fleet-check measures how alike your sessions still look. They run in parallel
on one daemon that keeps them alive: a crashed renderer is relaunched on the
same profile, parked sessions have their renderers stopped and thawed on the
next call, leases stop two agents clobbering one session, and goals give a task
a step/spend/time budget that survives a daemon restart.
**2. Credentials an agent can use but never see.** The vault fills a password
or a live TOTP code into the page without the value reaching the model's
context, a screenshot or a log — and only into the site it belongs to. Over
MCP, a prompt-injected agent can't type your GitHub password into a lookalike
page, can't read it back with value or eval while it sits in the field, and