Stealth Mode

Overview

Stealth Mode refers to Yukkai Browser's built-in ability to navigate and interact with websites while reducing the signals that anti-bot systems use to detect automated traffic. Because Yukkai Browser is powered by Apple's native WebKit engine — the same engine that drives Safari — it produces a genuine browser fingerprint out of the box, without requiring third-party patches or headless-browser workarounds.

Unlike traditional automation tools that rely on headless Chromium or Puppeteer (which are trivially detected by modern bot-protection services), Yukkai Browser runs as a real, visible WKWebView instance with a legitimate Safari User-Agent string, full JavaScript support, and native rendering. This makes its baseline fingerprint indistinguishable from a human using Safari on macOS.

On top of this natural advantage, Yukkai provides a suite of human-like interaction actions that add behavioural stealth — simulating organic mouse movements, variable typing speeds, and natural scroll patterns — so that your automated browsing sessions are far less likely to trigger CAPTCHAs, rate limits, or IP bans.

How it works

Stealth Mode is not a single toggle; it is the combined effect of several layers working together:

1. Native WebKit fingerprint

Yukkai Browser is built on WKWebView, Apple's native web view component. This means:

• Real Safari User-Agent — The browser identifies itself as genuine Safari, not as a headless or automation framework.
• Full JavaScript engine — Modern SPAs (React, Vue, Angular) render exactly as they would for a human visitor.
• Native canvas and WebGL rendering — Canvas fingerprinting queries return real, hardware-accelerated results consistent with a Mac.
• Standard TLS stack — Network requests use Apple's native networking stack, producing TLS fingerprints that match Safari, not Go or Node.js HTTP clients.

2. Human-like interaction actions

Three dedicated actions simulate human behaviour at the DOM-interaction level:

Action	What it does	Why it helps
human_click	Moves the cursor to the element with natural easing, then clicks with a small random delay.	Many bot detectors monitor click coordinates, timing, and whether mousedown/mouseup events arrive in natural sequence.
human_type	Types text character by character with variable inter-key delays (40–120 ms range).	Form fillers that paste text instantly are flagged instantly; human typing has natural rhythm and occasional typos.
human_scroll	Scrolls the page with variable speed, direction changes, and pauses.	Bots scroll in fixed increments; humans scroll irregularly and sometimes pause to read.

3. Session persistence

Yukkai can save and restore browser sessions (cookies, local storage) via the save_session and load_session actions. This means you can:

• Log in once as a human (handling CAPTCHAs, 2FA, passkeys yourself).
• Save that authenticated session.
• Reuse it in future automated tasks without re-triggering login-based bot detection.

4. Request interception

The start_interceptor action captures network requests (fetch/XHR) made by the page. This is useful for understanding what tracking endpoints a site calls, so you can identify fingerprinting scripts and data-collection APIs.

How to use it

Stealth Mode techniques are available through the Yukkai Browser tool. Here is how to activate each layer:

Basic stealth (just browse)

Simply navigating with Yukkai Browser already gives you a Safari-grade fingerprint. No special configuration is needed:

web_browse(action: "navigate", url: "https://example.com")

Human-like clicking

Instead of a regular click, use human_click for elements that may be monitored:

web_browse(action: "human_click", index: 5)

Human-like typing

Replace input_text with human_type when filling forms, search boxes, or login fields:

web_browse(action: "human_type", index: 4, text: "your search query")

Human-like scrolling

Use human_scroll instead of the standard scroll action:

web_browse(action: "human_scroll", direction: "down")

Save and reuse authenticated sessions

# Step 1: Open the browser visibly and log in yourself
web_browse(action: "show", url: "https://example.com/login")
# ... complete login, 2FA, CAPTCHA manually ...

# Step 2: Save the session
web_browse(action: "save_session", session_name: "my-account")

# Step 3: In a future task, restore it
web_browse(action: "load_session", session_name: "my-account")

Inspect tracking requests

# Start capturing network calls
web_browse(action: "start_interceptor", url_pattern: "*track*")

# ... navigate and interact ...

# Retrieve captured requests
web_browse(action: "get_intercepted", clear: true)

# Stop capturing
web_browse(action: "stop_interceptor")

Examples

Example 1: Search a site without triggering bot protection

# Navigate to a search-heavy site
web_browse(action: "navigate", url: "https://news-site.com")

# Type a search query like a human
web_browse(action: "human_type", index: 4, text: "AI regulation 2025")

# Click the search button naturally
web_browse(action: "human_click", index: 5)

# Scroll through results organically
web_browse(action: "human_scroll", direction: "down")

Example 2: Collect data from an infinite-scroll page

# Use scroll_and_collect with human-like scroll pauses
web_browse(
  action: "scroll_and_collect",
  selector: ".article-card",
  max_items: 50,
  scroll_pause: 2000,
  extract_js: "el => ({ title: el.querySelector('h2').innerText, link: el.href })"
)

Example 3: Log in once, then automate

# First time: visible browser, manual login
web_browse(action: "show", url: "https://portal.example.com")
# User completes login + 2FA in the visible window
web_browse(action: "save_session", session_name: "portal-auth")

# Later automation runs: invisible, fast, authenticated
web_browse(action: "load_session", session_name: "portal-auth")
web_browse(action: "navigate", url: "https://portal.example.com/dashboard")
web_browse(action: "extract")

Tips

Do's

• Use human_click and human_type for sensitive interactions. Standard click and input_text are fine for simple page reads, but login forms, search boxes, and rate-limited endpoints benefit from human-like timing.
• Save sessions after manual logins. This avoids repeated CAPTCHA solving and reduces the number of authentication events that could flag your account.
• Add delays between actions. Bots operate in milliseconds; humans take seconds. Insert web_browse(action: "wait", timeout: 2000) between steps on high-security sites.
• Use scroll_and_collect with generous scroll_pause. A 1.5–3 second pause between scrolls mimics reading behaviour and reduces the chance of triggering lazy-load-based bot traps.
• Monitor intercepted requests. Use start_interceptor to learn which endpoints a site calls for fingerprinting. This helps you understand what data is being collected.

Don'ts

• Don't use Stealth Mode to bypass paywalls or terms of service. Yukkai's stealth features are designed for legitimate automation — research, data collection from public pages, and authenticated workflows where you have the right to access the content.
• Don't rely solely on stealth for high-security sites. Some sites (banking, ticketing) use behavioural analysis that goes beyond simple fingerprinting. For those, open the browser visibly (show) and take manual control.
• Don't share session files. Saved sessions contain authentication cookies. Treat them like passwords — they grant access to the accounts they represent.
• Don't set unrealistic scroll_pause values. A 0 ms pause defeats the purpose of human-like scrolling. Keep it above 1000 ms for believable behaviour.

When stealth matters most

Scenario	Stealth benefit
Research scraping on news / blog sites	Avoids soft IP bans and CAPTCHA walls
Social media monitoring	Reduces the chance of account flagging for automation
Price comparison and e-commerce	Prevents being served different (bot-targeted) content
SEO and ranking checks	Ensures you see the same results a human would
Authenticated portal automation	Session reuse avoids repeated 2FA prompts

Limitations

Stealth Mode significantly reduces detection risk but does not make you invisible. Sophisticated bot-protection services (Cloudflare Turnstile, DataDome, PerimeterX) may still detect automation through:

• Deep behavioural analysis (mouse trajectory entropy, click distribution).
• TLS JA3/JA4 fingerprinting (though WebKit's native stack is harder to distinguish).
• IP reputation (datacenter IPs are flagged regardless of browser fingerprint).

For sites with these protections, the best approach is to open the browser visibly, log in as a human, save the session, and then use that authenticated session for subsequent automated tasks within reasonable limits.