Open-Source Anti-Bot Scraping Libraries and When to Use an API
Every library's status was re-checked on 2026-10-26 from GitHub and PyPI/npm. Undetected-Playwright-Python is archived and points to its successor, Patchright, which now has its own section, as do Camoufox and curl_cffi. ScrapeGraphAI moved to a short note because it is an LLM extraction library, not an anti-bot tool. Unsourced statistics and benchmark claims were removed. Code and data: evidence packet.
Anti-bot systems such as Cloudflare, DataDome, PerimeterX (HUMAN) and Akamai look at many signals at once: the IP address and its reputation, the TLS handshake, the browser's JavaScript environment, and how the visitor behaves. Open-source libraries attack different parts of that list. None of them covers all of it, and how well they work changes every time the anti-bot vendors update.
This page lists the libraries that are worth a look in 2026, with their maintenance status, and ends with the cases where a scraping API is less work.
Which signal each library targets
| Library | Language | Targets | Status on 2026-10-26 |
|---|---|---|---|
| Botasaurus | Python | Browser and request scraping with anti-detection built in | Last push 2026-07-26; PyPI 4.0.97 (2026-01-06) |
| Nodriver | Python | Chrome driven over CDP without WebDriver | Last push 2026-10-08; PyPI 0.50.6 (2026-10-08) |
| Patchright | Python, Node.js | A patched Playwright that removes automation leaks | Last push 2026-10-25; PyPI 1.64.3 (2026-10-25) |
| Camoufox | Python, Node.js | A modified Firefox with fingerprint control | Last push 2026-10-25; PyPI 0.5.8 (2026-10-06) |
| curl_cffi | Python | TLS and HTTP/2 fingerprints of an HTTP client (no browser) | Last push 2026-10-26; PyPI 0.17.0 (2026-10-26) |
| Puppeteer Stealth | Node.js | Evasions for headless Chrome in Puppeteer | Repo last push 2024-07-18; npm 2.11.2 (2023-03-01) |
| Botright | Python | Playwright with fingerprint changes and CAPTCHA solving | Repo now under vinyzu-archive, last push 2026-10-20 (sponsor README edits); PyPI 0.5.1 (2024-02-15) |
| Undetected-Playwright-Python | Python | Patched Playwright | Archived; the repo says it moved to Patchright |
"Last push" and release dates come from the GitHub API and the package registries on the day of the update. A recent push is no promise that a library gets past a given site; an old release is a strong hint that it won't.
Botasaurus
Botasaurus describes itself as an all-in-one framework for building scrapers. It wraps a browser (and a plain request mode) with anti-detection defaults, parallel runs, caching and helpers for proxies, so a lot of the plumbing is done for you. It is the most "batteries included" option on the list. The trade-off is that you work inside its framework rather than plain Playwright or Selenium code.
Nodriver
Nodriver is the successor to Undetected-Chromedriver, by the same author. Instead of Selenium and WebDriver, which leave detectable traces, it talks to Chrome directly over the DevTools protocol and is fully asynchronous. It is a good fit if you know Selenium-style scraping and want fewer automation leaks without changing to Playwright.
Patchright
Patchright is a drop-in replacement for Playwright with patches that remove the most common automation leaks. It replaced Undetected-Playwright-Python, whose repository is now archived and points here. Because the API matches Playwright, existing scripts usually only need a different import. It tracks Playwright releases closely (1.64.3 on 2026-10-25).
Camoufox
Camoufox takes a different route: a modified Firefox built for anti-detection, with its fingerprint (screen, fonts, WebGL and more) controlled from Python or Node.js. Firefox-based automation is less common than Chrome-based, which is part of its appeal. It is the heaviest option here, since it ships its own browser build.
curl_cffi
Not every target needs a browser. Some block plain HTTP clients by their TLS and HTTP/2 fingerprint before looking at anything else. curl_cffi is a Python binding to a curl fork that can impersonate a browser's TLS (JA3) and HTTP/2 fingerprints, with a requests-like API. If a site blocks requests but the data is in the HTML, try it before reaching for a browser.
Puppeteer Stealth
puppeteer-extra-plugin-stealth was for years the default answer for Puppeteer: a set of evasions for the most obvious headless Chrome tells. Its last npm release is from March 2023 and the repository has not been updated since July 2024, while Chrome and the detection vendors have moved on. It is still useful as a reference for what a headless browser leaks; for new work, compare it with the maintained options above. Our Puppeteer Stealth guide shows how to set it up.
Botright
Botright combined Playwright with fingerprint changes and built-in CAPTCHA solving. Its repository has moved to a vinyzu-archive organisation, its last three commits (September and October 2026) only update a sponsor block in the README, and the last PyPI release is from February 2024, so treat it as unmaintained.
A note on ScrapeGraphAI
ScrapeGraphAI (v2.3.1, October 2026) is often listed next to these tools, but it solves a different problem: it uses an LLM to turn a page into structured data. It does nothing about getting blocked. See our ScrapeGraphAI tutorial for how it works.
What a default headless browser gives away
To see why these libraries exist, here is plain Playwright in its default headless mode, opening a page that echoes the request headers:
import { chromium } from 'playwright';
const browser = await chromium.launch(); // headless by default
const page = await browser.newPage();
await page.goto('https://httpbin.org/headers');
const userAgent = JSON.parse(await page.innerText('body')).headers['User-Agent'];
console.log('User-Agent:', userAgent);
console.log('navigator.webdriver:', await page.evaluate(() => navigator.webdriver));
await browser.close();
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36
navigator.webdriver: true
The User-Agent says HeadlessChrome, and navigator.webdriver is true. Any site can check both in one line, and these are only the first two of many signals the libraries above try to hide. For more on what Playwright exposes, see how sites detect Playwright and making Playwright scraping undetectable.
ScrapingAnt API
When an API is less work
With the libraries above you run the browsers or HTTP clients yourself and bring your own proxies. With the ScrapingAnt API, one request loads the page in a cloud browser behind ScrapingAnt's proxies, and you get the HTML back. Here is the same check for a page loaded through the API, with a js_snippet that writes navigator.webdriver into the page so we can read it back. Requests the API answers with a non-200 status are not charged, and there is a free plan to start.
// The same two signals for a page loaded by the ScrapingAnt API.
// js_snippet runs in the page and writes navigator.webdriver into the HTML we get back.
const snippet = "document.body.dataset.webdriver = String(navigator.webdriver)";
const params = new URLSearchParams({
url: 'https://httpbin.org/headers',
'x-api-key': process.env.SCRAPINGANT_API_KEY,
js_snippet: Buffer.from(snippet).toString('base64'),
});
const response = await fetch(`https://api.scrapingant.com/v2/general?${params}`);
const html = await response.text();
console.log(response.status, response.headers.get('ant-page-status-code'));
console.log('User-Agent:', html.match(/"User-Agent":\s*"([^"]+)"/)[1]);
console.log('navigator.webdriver:', html.match(/data-webdriver="([^"]+)"/)[1]);
200 200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
navigator.webdriver: false
A regular Chrome User-Agent and navigator.webdriver: false. Run on 2026-10-26 with Node.js 22.20. These are two signals, not a test against a specific anti-bot product; the Cloudflare and CAPTCHA page in the docs covers what the API does about those.
How to choose
- The data is in the HTML and only plain clients are blocked: try curl_cffi first.
- You need a real browser and already use Playwright: try Patchright; for Firefox, Camoufox.
- You come from Selenium: Nodriver.
- You want a framework that handles the plumbing: Botasaurus.
- You need many targets, many countries, or don't want to run browsers and proxies at all: a scraping API. For a comparison of approaches, see Python detection avoidance libraries and JavaScript detection avoidance libraries.
Whichever you pick, test on your own target before you commit, keep request rates reasonable, and respect the site's terms.
Status checked on 2026-10-26 from the GitHub API, PyPI and npm. Example tested on 2026-10-26 with Node.js 22.20.0 and playwright 1.64.1. Code: scrapingant-examples/examples/open-source-web-scraping-libraries-bypass-anti-bot.
This update was drafted with AI assistance from a tested evidence packet and reviewed by Oleg Kulyk, who is responsible for the code, measurements and corrections.