svipall

A different face at every gate.

Web reading for your AI agent, running on your own machine.
An MCP server and CLI, in Rust, that extracts web pages into Markdown,
crawls sites within configured limits, searches without an API key,
and attempts supported challenges, then says plainly which ones it could not.

Install · Use cases · Proof · Tools · Captcha · REST API · Compare · FAQ

_{Replayed from real runs on one machine. How it was recorded, and the raw captures.}

Everything runs locally. There are no third-party API keys, no paid captcha services and no
telemetry.
Web requests reach the sites you visit, and results reach the agent or client you connect.

Svipall fetches and renders pages locally, extracts their content, and reports detected challenges
and extraction-quality labels. Some sites still block it, and an apparently successful response
can contain incomplete records or a page shell. The published comparisons therefore audit useful
content separately from HTTP status and the tool's own verdict.

Why Svipall

It records successful visits, failures, incomplete extraction and rejected changes. Historical
benchmark logs and the current comparison use different scoring rules and configurations;
the results section distinguishes them.

Rust · MCP + CLI + REST · no Node, no Python, no API key · local storage and processing

Install it

The comparison table describes other projects' documented scope.

Install

Every channel below installs the latest release,
built from the tree this README describes. svipall doctor reports what an installed build can do
on the machine it is on.

The README factual audit
records the source checks, documentation corrections and limits of this review.

Choose agent-assisted setup, the Claude Code plugin, or a manual installation.

Ask the agent you already have

Paste this into Claude Code, Cursor, Codex, opencode, or anything else that can run a command:

Install and configure Svipall by following the instructions here:
https://raw.githubusercontent.com/ilien-dev/svipall/main/docs/install.md

That page guides an agent through platform detection and verification, then asks which integration
you want: CLI + Skill (recommended, lower context use) or MCP + Skill (the full MCP tool
surface). It also asks whether to configure every project or only the current one, and verifies the
chosen result instead of treating a skill as MCP registration. When Svipall already exists, it
shows the installed and latest versions and asks whether to update the shared user installation or
keep the current version before it writes the integration. Completion depends on the agent, client
configuration and available permissions.

Claude Code: install the plugin

/plugin marketplace add ilien-dev/svipall
/plugin install svipall@svipall
/svipall:setup

/svipall:setup installs the binary if it is missing, checks the server answers, and offers to make
Svipall the way Claude reaches the web in every project. It asks before each of those.
/svipall:doctor reports the installation's capabilities. /svipall:update shows the installed
and latest releases, then updates the binaries only if you choose to. /svipall:uninstall offers
removal of setup's registration, memory and strict-mode changes. Removing the binary and the data
are separate choices.

Install it yourself

One line, with no toolchain and nothing to compile:

curl -fsSL https://raw.githubusercontent.com/ilien-dev/svipall/main/install.sh | sh   # macOS, Linux
irm https://raw.githubusercontent.com/ilien-dev/svipall/main/install.ps1 | iex        # Windows

Or a package manager, or the container image:

brew install ilien-dev/svipall/svipall               # macOS, Linux
scoop bucket add svipall https://github.com/ilien-dev/scoop-svipall && scoop install svipall
docker pull ghcr.io/ilien-dev/svipall:latest         # or :slim, the http tier only; see container notes
npx --yes svipall doctor                             # if node is already there
cargo install svipall                            # from source; add `svipall models install` for the models

The installers verify checksums where they can, and a mismatch stops the install. A missing
checksum file, entry or hashing utility only warns, so a successful exit is not by itself proof
the archive was verified: read the output. If the destination already contains another version,
the installer states that the binaries are shared by every harness and asks before replacing them.

Check for a release without changing anything, or update after reviewing the report:

svipall update --check
svipall update --install       # only after choosing to update the shared installation

Platform builds, what ships where, building from source and wiring it into any MCP client are all
in docs/install.md. If you have never installed anything from a terminal,
GET-STARTED.md is this section with nothing assumed.

Then ask for something

There is no key to paste and no account to create.

"Read this page and summarise the pricing."
"Crawl these docs and write me an llms.txt."
"Watch this listing and tell me when the price moves."
"Get me every row of that table as CSV."

The assistant can choose among the exposed tools. Supported challenges that need a pair of eyes
go to a human dashboard at http://localhost:8787/human.

Or drive it from a shell

svipall fetch https://example.com/article
svipall fetch https://shop.example/item --query "shipping costs"
svipall fetch https://docs.example/api --schema auto        # rows from a listing you've never seen
svipall crawl https://docs.example/ --pages 50 --out pages.csv
svipall search "rust async runtime" --engine all
svipall snapshot https://news.ycombinator.com                # the page as roles and refs, not markup
svipall serve --port 8788                                    # the same server as a local REST API

Completed data commands print one JSON object to stdout and diagnostics to stderr, so the
output can be piped to jq. serve is a long-running server, and help is written to stderr.

What comes back

A historical run of svipall fetch https://example.com, with the content string cut short.
Current automatic fetches also report identity_used, and the fallback fields described below when
they have something to report:

{
  "attempts": ["http: 200 (170ms) OK"],
  "chars": 167,
  "content": "# Example Domain\n\nThis domain is for use in documentation examples…",
  "final_url": "https://example.com/",
  "optimization": "ordinary",
  "quality": "thin",
  "quality_reasons": ["thin_text"],
  "status": 200,
  "tier_used": "http",
  "title": "Example Domain",
  "tokens_estimated": 42,
  "url": "https://example.com"
}

tier_used says how hard it had to try and quality says what actually arrived. When a page does
not arrive, the same object carries blocked_reason, wall_kind, wall_vendor, wall_evidence
and a note telling your agent what to do next. Straight from a committed benchmark record:

{ "wall_kind": "vendor", "wall_vendor": "kpsdk.io", "wall_evidence": "header x-kpsdk-ct" }

A detected block carries a verdict alongside the returned content. A clear verdict still needs a
content check, because the classifier cannot show that the requested records arrived intact.

What you can actually do with it

Who it is for

Svipall runs on your own hardware. If you want a URL you can curl from a serverless function,
use a hosted scraping service instead. If you want the web inside your own agent, Svipall does that
processing locally; browser traffic and optional downloads are described under
Privacy and safety.

How it works, in plain words

The steps below describe the emulated tiers. The current automatic policy can promote a supported
emulated route and append one eligible native fallback. Wall verdicts can end the attempt.
Content-quality labels alone do not trigger escalation.

1. Ask for the page through HTTP first on a new route. The default engine emulates selected
   Chrome network characteristics. In the historical public31 runs above, 59 of 93 cells stopped at this tier, and
   44 of those scored ok under that benchmark's rule. A route that stops here has still not
   necessarily delivered the page.
2. If the page needs JavaScript, open a browser. Headless Chromium runs the scripts and hands
   back the rendered document.
3. If the site checks for robots, wear a disguise. The stealth tier patches known browser
   surfaces to match the emulated identity. The offline probes check those surfaces; they cannot
   prove that an arbitrary detector will accept them.
4. If the site wants a real person, act like one. The real tier is a visible-but-offscreen
   browser with a persistent profile. It moves the pointer along curves and scrolls with a wheel.
5. If there is a challenge, answer it or wait it out. The warm tier runs the captcha strategy
   loop during its bounded wait and avoids pointer activity on recognized self-verifying
   interstitials. This does not guarantee clearance.
6. Use native only as a last resort. When eligible and within the remaining budgets, try one
   native browser attempt. It exposes real device characteristics and reports a privacy notice.
7. Remember what worked. Two supporting observations can promote a useful emulated route for
   later visits in the same context. Native stays last even when it succeeds.
8. Report the observed failure. Where available, a blocked result includes blocked_reason,
   the classified wall, recognized vendor/evidence and a suggested next step. Classification is
   heuristic. Transport errors and local budget deferrals may have less page evidence.

MCP tools

Twenty-nine tools, all local.

The CLI

svipall fetch | crawl | snapshot | capture | search | map | log | notes | watch
        profile | browser | route | status | serve | doctor | update | hook
        config show | set | preset
        solver export-corpus
        quality ask | export-training | train

A test asserts the usage text names every command the binary answers to, and a second test keeps
skill/SKILL.md in step with both.

The REST API

The same server, over HTTP, so any language can drive it without an MCP client or a shell.

svipall serve --port 8788        # the bearer key is printed once, and kept in ~/.svipall/api_key
curl -sH "Authorization: Bearer $KEY" -H 'content-type: application/json' \
     -d '{"url":"https://example.com","query":"pricing"}' localhost:8788/v1/fetch

svipall-mcp mounts the same router when rest_port is set, on its own listener, and shares its
browser pools, page cache and route evidence with the MCP tools.

Nineteen routes, one per tool, each taking that tool's own JSON as the body:

A blocked page is a 200: the call ran, the page did not. blocked_reason, wall_kind and
note can appear in the body as over MCP. Non-2xx responses include a malformed body (400), a bad key
(401), a browser Origin or a rebound Host (403), a body over 2 MB (413) or a broken
installation (500). An unknown job can return 404, and routing can reject unsupported paths
or methods. A client must inspect both the HTTP status and the tool result before deciding to retry.

Every tool and job route needs the key, including on loopback. Only /v1/health is exempt.
A local port is not a boundary on its own: Svipall carries logged-in profiles, cookies and your
exit address, so anything that reaches the port can make requests as you.
Two more checks sit in front of the key, because binding to 127.0.0.1 does not stop a page in your
own browser being served a DNS answer of 127.0.0.1 and posting to it: any request carrying an
Origin header is refused, and on a loopback bind so is any Host that is not loopback. There is no
CORS layer and there will not be one, because no browser page is a client of this API.

Ten tools are deliberately not routes, in three groups, and rest.rs records why next to each:
browser_open/browser_do/browser_close, whose persistent session lifecycle is outside this
REST interface's current design; web_login, whose interactive window is also excluded; and the six
solve_*/captcha_status/report_captcha tools, which already answer on the dashboard port in the
classic solver wire shape. Twenty-nine tools minus those ten is the nineteen routes above. A new
#[tool] fails the test suite until it is listed as a route or as a named exclusion.

A long crawl runs as a job and does not hold the connection. "async": true answers 202 with an id. GET /v1/jobs/{id} polls it, GET /v1/jobs/{id}/stream follows it as Server-Sent Events, DELETE stops
it. The id is the crawl_id, so there is one handle to learn and resuming is {"crawl_id": "…"},
the same word the MCP tool and the CLI already use. A cancelled crawl stops between pages after
that page's links are queued, so its frontier is kept. It is never aborted, because that would leak a
browser page. A job whose process was killed becomes interrupted, and interrupted is resumable.
The first frame of a stream is always a snapshot from the store, so a subscriber that joins at page
forty is never told the job started at zero. And a queued job whose site already has one running is
held back: two crawls of one site would spend one address's reputation with that host twice as fast,
which is the scarcest thing a local-only tool has. Full contract in docs/rest.md.

How Svipall compares

The following describes project scope from primary documentation checked on 2026-09-07.
It is not a feature-exhaustive comparison or a head-to-head performance test.

The historical benchmark above does not establish current superiority over these
projects. Choose based on your required integration and validate your own target pages.

Everything else

This file is the short version. Everything it leaves out is in the documents below.

About the name

Svipall is one of Odin's names in Grímnismál, stanza 47. Bellows renders it as
"The Changing" in his translation notes.
The project uses that name as an image of changing appearance, not as a promise of invisibility.

That is the idea behind its emulated identities: keep the machine, browser, network fingerprint
and input behaviour coherent within a session, and retire sessions when they are refused.
Native fallback instead uses real browser/device characteristics. Neither policy guarantees that
a site will accept the visit or be unable to link it to an earlier one.

License

AGPL-3.0-only, subject to the terms in LICENSE, including its conditions for
distribution and section 13 on remote network interaction. The component licences and linking
exception below also apply. This paragraph is not a substitute for those terms.

crates/svipall-extract, the extraction engine, is deliberately MIT OR Apache-2.0 so that a
project under any licence can depend on it. crates/svipall-cdp keeps its upstream terms
(chromiumoxide, MIT OR Apache-2.0) and crates/svipall-quic keeps its own (quiche, BSD-2-Clause). The default build links BoringSSL under an explicit AGPL section 7 linking
exception. These are set out in NOTICE and
THIRD-PARTY-NOTICES.md.

Contributions are taken under CLA.md: contributors keep the copyright in their work and
grant the maintainer a licence broad enough to also release it under other terms. The public
release stays AGPL-3.0-only. For a licence other than the AGPL, write to [email protected].

Trademark

The name Svipall and the Svipall logo are trademarks of the author. They are not licensed
under the AGPL, and nothing in this repository grants a licence to them.

The licence gives you the code. It does not give you the name. Run it, study it, modify it, fork it
and redistribute it freely under the AGPL. Distribute a modified version under a different name
and without the logo, so that nobody who downloads it is misled about who produced it or what is
in it.

The project permits descriptive references such as saying that your project uses Svipall,
works with Svipall, or is a fork of Svipall, without implying endorsement.

Disclaimer

Svipall is provided as is, with no warranty and no liability, and it grants you no
authorisation with respect to any system you point it at. Complying with the law, with
data-protection rules and with a site's terms is the operator's responsibility, not the author's.
Read DISCLAIMER.md before you run it against something that is not yours.

_{Keywords: web scraping · web crawler · MCP server · Model Context Protocol · Claude Code · Claude Desktop · Cursor · AI agent tools · LLM web browsing · LLM-ready markdown · html to markdown · RAG data pipeline · anti-bot bypass · Cloudflare bypass · Turnstile · Akamai · PerimeterX · DataDome · Kasada · captcha solver · local captcha solving · headless browser · stealth browser · browser fingerprint · TLS fingerprint JA4 · Chrome impersonation · HTTP/3 QUIC · proxy rotation · Rust · Playwright alternative · Firecrawl alternative · Crawl4AI alternative · Scrapling alternative · local-first · self-hosted · privacy · no API key}