Add more stealth patterns (Cloudflare Turnstile bypass, fingerprint hardening)

[MathiasPaulenko]

Add more stealth patterns (Cloudflare Turnstile bypass, fingerprint hardening)

Context

WaveXisMCP has a basic stealth mode (stealth=true) that hides navigator.webdriver, fakes plugins/languages/chrome runtime, and patches navigator.permissions. This is enough for basic bot detection, but more advanced anti-bot systems (Cloudflare Turnstile, DataDome, PerimeterX) require deeper fingerprint hardening.

Competitors like zendriver-mcp and nodriver-mcp have built-in Cloudflare bypass. Adding more stealth patterns would close this gap.

What needs to happen

In wavexis (the library)

Extend wavexis/actions/stealth.py with additional patches:

1. Canvas fingerprint — add noise to HTMLCanvasElement.prototype.toDataURL and toBlob
2. WebGL fingerprint — spoof WEBGL_debug_renderer_info vendor/renderer
3. AudioContext fingerprint — add noise to AudioContext.prototype.createAnalyser
4. Font enumeration — spoof document.fonts and font measurement results
5. ClientRects fingerprint — add subtle noise to getClientRects and getBoundingClientRect
6. Navigator properties — spoof navigator.hardwareConcurrency, navigator.deviceMemory, navigator.platform (already partially done)
7. WebRTC leak prevention — override RTCPeerConnection to prevent local IP leaks
8. Cloudflare Turnstile — detect and wait for Turnstile challenges, auto-solve simple ones

In wavexis-mcp

No changes needed — the stealth=true flag already passes through to the backend.

Implementation notes

• Each patch should be a separate JS string that can be injected via Page.addScriptToEvaluateOnNewDocument (CDP) or script.addPreloadScript (BiDi)
• Patches should be toggleable (e.g., stealth_level=1 for basic, stealth_level=2 for advanced)
• Must not break legitimate functionality (e.g., canvas noise should be deterministic per-session, not random per-call)
• Add tests that verify the patches are injected and don't throw errors

Getting started

1. Read wavexis/actions/stealth.py to see the existing patches
2. Read how stealth JS is injected in wavexis/backend/cdp.py and wavexis/backend/bidi.py
3. Research fingerprinting techniques (check out fingerprintjs for reference)
4. Add patches one at a time, with tests
5. Open a PR per patch group for easier review

References

• Existing stealth code
• Cloudflare Turnstile docs
• Browser fingerprinting techniques
• puppeteer-extra-stealth plugin (reference implementation)