One browser engine to rule them all

Stealth Chromium engine · v3 (Chromium 153)

Fortress is a stealth Chromium engine that stops your scrapers and browser agents from getting blocked, with one line of code change. Bot detectors flag automation by reading the browser fingerprint; Fortress corrects that fingerprint inside Chromium's C++, so the browser presents as an ordinary Chrome install. Scrapers finish their runs, agents reach the pages they were sent to, and CreepJS, Sannysoft, BrowserScan, and live Cloudflare Turnstile all read it as human. Point your existing Playwright or Puppeteer at Fortress over CDP, and nothing else in your code changes. With v3, every launch is a different coherent machine, so a fleet of sessions looks like a crowd of real users.

Headless, on datacenter IPs, with no proxies, Fortress served 86.4% of 92 protected pages; the next best stack (Camoufox) served 74.5%.

_{Blink · V8 · BoringSSL patched in-tree · ANGLE / D3D11-backed WebGL · JA3/JA4-coherent TLS · monthly upstream rebase · reproducible, gauntlet-gated releases}

81 single-surface C++ patches

0% CreepJS headless / stealth

48/48 distinct across a 64-clone fleet

[native code] across every realm

_{Unedited capture of the Fortress binary in a real window: it clears a live Cloudflare challenge, turns bot.sannysoft.com all green, then reads BrowserScan “Normal”. Reproduce with tools/gauntlet.py.}

What's new: v3 · 153.0.8010.36 · Fleet Engine

v3 turns Fortress from a coherent single persona into a coherent fleet engine: 87 commits on patches/, a Chromium 151/152 to 153 rebase, and the changes below.

• IPC persona graph, shipped. The persona is delivered to the renderer over IPC into a process-global config: zero command-line footprint and per-context identity isolation, so multiple sessions or accounts in one browser never collapse into a single linkable identity.
• on_restore fleet re-identity. On snapshot resume the entire persona re-keys in place (RNG, canvas/audio, GPU/screen/UA, network and TLS state) with no relaunch, confirmed by a closed-loop per-surface ack. A 64-clone fleet comes up 48/48 distinct, stress-gated to 500 clones.
• Byte-exact canvas and audio. Canvas noise is idempotent and byte-exact across getImageData / toDataURL / toBlob (and OffscreenCanvas), edge-gated to anti-aliased pixels only, with 64-bit domain-separated seeds and a fail-closed RNG (a zero or absent seed disables the noise; no golden constant can leak). WebGL/WebGL2 readback, including PBO readPixels, routes through the same edge-gated path. Audio farble is value-keyed: identical inputs give identical outputs, fresh per persona yet internally stable.
• Coherent WebGL and WebGPU. Both agree with the persona GPU at the parameter level: limits, precision, extensions, and navigator.gpu adapter identity all match a real hardware GPU, never the software backend. Verified live.
• A real font substrate. 154 distinct bundled font families with real metric clones and per-persona metrics; enumeration is gated to the persona so host fonts are never visible.
• Coherence everywhere. About thirty specific tells closed, each with a coherence rule in place of a spoof: @media matches screen and DPR, color-gamut and dynamic-range, jsHeapSizeLimit matches deviceMemory, prefers-color-scheme per persona (about a third dark), Windows system fonts, Device-Memory client hint on the navigation request path, WebAuthn isUVPAA() per persona, macOS zero-width overlay scrollbars, fail-closed WebRTC (no real-IP leak on a bare launch), pointer/hover/maxTouchPoints pinned, OS-appropriate speechSynthesis voices, and coherent Mac personas (Apple arch, core and RAM SKUs, a MacBook that is not permanently plugged in).
• Recorded-human mouse motion. An engine-native trajectory engine backed by a bank of ~10k recorded-human paths (SapiMouse) paces the cursor with organic velocity and micro-jitter, a ~16× more human motion signal than a raw driver (humanness gap ~4.3 vs ~70). Speed-proportional getCoalescedEvents batching and per-persona realtime AudioContext timing round out the behavioral seed.
• Widevine EME, shipped. The real Widevine CDM is bundled and enabled, so requestMediaKeySystemAccess('com.widevine.alpha') resolves exactly as it does in a genuine Google Chrome. The DRM gap the roadmap flagged is closed.
• Native on more platforms. Windows x64 ships native (.zip + tillion.cmd); Linux arm64, x86 and armhf tarballs are rolling out; the macOS .app builds from source.

pip install -U tilion-fortress       # or:  docker run --rm -p 9222:9222 tilion/fortress:latest

Full release notes

Contents

What it is

Fortress is a Chromium fork that spoofs the browser fingerprint from inside the engine. The surfaces bot detectors read (canvas, WebGL, WebGPU, audio, fonts, navigator, Client-Hints, and about forty more) are corrected in Chromium's C++, with no JavaScript patch layer sitting on top for a page to catch.

It ships as an ordinary browser binary that exposes a CDP endpoint. Point Playwright, Puppeteer, or any CDP client at it and your existing automation runs unchanged.

A JavaScript stealth patch leaves an extra layer the page can find: .toString() shows the override's source, and re-grabbing the same primitive from an iframe or worker reaches past it. Fortress corrects the surface in the engine instead, so navigator.vendor resolves to the real C++ getter, reports [native code], and reads the same from every realm. A page inspecting itself sees stock Chromium. That is why your automation gets through where it used to get flagged, and whatever blocking is left traces to your proxies and behavior rather than the browser. Why patch the engine, not the page covers the detection mechanics in full.

With v3 the persona is no longer a single fixed identity. Each launch mints a fresh, internally coherent machine (GPU, screen, cores, timezone, language, fonts, all in agreement), delivered to the renderer over IPC, so nothing shows on the command line and every BrowserContext can hold its own identity.

from tilion_fortress import Fortress
from playwright.sync_api import sync_playwright

with Fortress() as f:                                   # launches the stealth engine on a CDP endpoint
    with sync_playwright() as p:
        browser = p.chromium.connect_over_cdp(f.cdp_url)
        page = browser.new_page()
        page.goto("https://bot.sannysoft.com")
        page.screenshot(path="all-green.png")

import { Fortress } from "tilion-fortress";
import { chromium } from "playwright";

const f = await Fortress.launch();                      // stealth engine on a CDP endpoint
const browser = await chromium.connectOverCDP(f.cdpUrl);
const page = await browser.newPage();
await page.goto("https://browserscan.net");
await browser.close();
await f.close();

Real scraping, fully headless

_{Unedited captures of the Fortress engine driven over CDP. No stealth plugins, no JS patches: the fingerprint is corrected in the binary. Reproduce any of these with examples/scrape_demos.py.}

_{Structured extraction: records build into typed JSON as each item is read.}

Auto-pagination: 30 quotes across 3 pages.

Deep detail crawl: UPC · price · tax · stock · reviews.

Clears real Akamai, before and after

_{Same residential IP, same site (aa.com · Akamai Bot Manager). A stock/headless browser gets Access Denied (Reference #); Fortress loads the real page and Akamai issues its _abck sensor cookie; the Bot Manager accepts it as a real browser. The IP is the same in both runs, so the variable is the fingerprint.}

_{The same before and after holds on lowes.com, macys.com and kohls.com, every run from the same residential IP.}

Every session a distinct machine

40 back-to-back launches of the same v3 binary, headless. Each one is a different, internally coherent machine, and no two sessions shared a canvas or audio fingerprint:

…30 more, all distinct. Every row is a coherent machine: GPU, screen, core count, timezone and language agree (Windows with Intel/AMD/D3D11, macOS with Apple/Metal; timezone, language and region matched). Reproduce with tools/gauntlet.py --runs 40.

Quick start

# Python / Node: prebuilt native binary auto-fetched (Linux x64 & Windows x64), SHA-256 verified
pip install tilion-fortress
npm  install tilion-fortress

# Any OS via Docker: raw CDP on :9222
docker run --rm -p 9222:9222 tilion/fortress:latest

# Portable tarball (Linux x64 / arm64 / x86 / armhf): use it like a Chromium snapshot
tar xzf fortress-v153-linux-x64.tar.gz
./fortress-v153/tilion https://example.com
./fortress-v153/tilion --headless=new --remote-debugging-port=9222 --user-data-dir=/tmp/p

# Native Windows x64: unzip and launch via the .cmd (raw CDP, same --uxr-* overrides)
#   fortress-v153-win-x64\tillion.cmd --headless=new --remote-debugging-port=9222 --user-data-dir=C:\tmp\p

# Debian / Ubuntu
sudo apt install ./tilion-fortress_153.0.8010.36_amd64.deb && tilion https://example.com

[!TIP] The SDK ships the compiled v3 engine, ready to run, and downloads are SHA-256-verified against the release SHA256SUMS automatically. The first-generation patch series is public to read and rebuild.

Free for developers, unlock in one command

Fortress v3 is free for developers, with no machine, session, or concurrency caps. One ten-second step turns a fresh install into the full engine: sign in with GitHub, Google, or email so we know who our developers are.

tilion activate      # opens your browser, sign in, done. Key saved to ~/.tilion/license.jwt

The key is verified offline after that; Fortress never phones home or reports usage. Skip activation and Fortress still runs: it prints one line and falls back to the public first-generation engine until you activate.

Developers	Free and unlimited. Each developer gets a unique key that auto-refreshes, so you activate once.
CI, Docker, AI agents (no browser)	Set TILION_LICENSE_KEY=<key> in the environment, or run tilion activate --token <key>. One key covers a whole fleet.
Enterprise	A production key from tilion.com/pricing for your org's fleet. Drop it in TILION_LICENSE_KEY.

The tilion CLI

pip install tilion-fortress (or npm install tilion-fortress) puts the tilion command on your PATH. The portable tarball and the Docker image bundle the same activator, so it works everywhere with no extra install.

Native builds: one engine, every platform

The same v3 engine ships as a native binary per platform, no container hop, from Releases. Each launch mints a fresh, coherent machine for that OS: a Windows build draws Windows personas (Win32 · D3D11 GPUs), verified 10/10.

Platform	Package	Widevine	Status
Linux x64	portable tarball · Docker · pip / npm		shipping
Windows x64	portable .zip + tillion.cmd launcher		shipping
Linux arm64	portable tarball (Graviton, dense cloud fleets)	no	shipping
Linux x86 · armhf	portable tarball (32-bit x86 / ARM)	no	shipping
macOS (arm64 / x64)	.app, built from source		build from source

_{All four Linux builds (x64 · arm64 · armhf · x86) and Windows x64 carry the same license gate; the 32-bit and arm64 cross-builds ship without the bundled Widevine CDM. macOS builds from source with Widevine on.}

_{Why native matters: a Windows persona on a real Windows host emits a genuine Windows TLS/JA4T and OS story for free (DirectWrite fonts, real Widevine DRM), and a Mac persona on real macOS gets HEVC decode, Apple Color Emoji, and the right DRM: the last substrate leaks a Linux host cannot fully paper over. One engine, every OS, the same 48/48-distinct fleet.}

Drop it into your AI agent

Fortress is the browser your agent drives: raw CDP on :9222, no stealth plugins to wire up. There are two ways in.

Option 1: open it pre-loaded in a chat assistant. One click; it reads our AGENTS.md and walks you through the whole setup:

Option 2: Copy for agent (everything, to your clipboard). Hit the copy icon at the top-right of the box below. It puts the entire setup context on your clipboard: what it is, install, connect, persona, and rules, all of AGENTS.md condensed. Paste it into Cursor, Claude Code, Copilot, ChatGPT, or any agent and it takes it from there:

You're setting up Fortress, a STEALTH Chromium engine, for browser automation.
It corrects the browser fingerprint (canvas, WebGL, WebGPU, audio, fonts, navigator, +40 more) in
Chromium's C++ and exposes raw CDP on http://localhost:9222, a drop-in for Playwright/Puppeteer.
Every launch is a fresh, coherent machine. Do NOT add puppeteer-stealth or any JS fingerprint
patching (it self-reveals and undoes Fortress).

LAUNCH (pick one; all expose CDP on http://localhost:9222):
  Docker:  docker run -d --rm -p 9222:9222 tilion/fortress:latest
  Python:  pip install tilion-fortress    then  from tilion_fortress import Fortress; f=Fortress(); f.start()
  Node:    npm install tilion-fortress    then  import {Fortress} from "tilion-fortress"; const f=await Fortress.launch()

CONNECT (keep my existing automation code):
  Playwright(py):  browser = p.chromium.connect_over_cdp("http://localhost:9222")
  Playwright(js):  const browser = await chromium.connectOverCDP("http://localhost:9222")
  Puppeteer(js):   const browser = await puppeteer.connect({ browserURL: "http://localhost:9222" })
  browser-use / Crawl4AI / Stagehand / LangChain:  point their CDP endpoint at http://localhost:9222

PERSONA (optional; the default is a fresh coherent identity per launch, delivered over IPC).
Pin or override any surface with --uxr-* flags:
  --uxr-timezone=America/New_York --uxr-hw-concurrency=16 --uxr-languages=en-US,en

RULES:
  1) Drive over raw CDP (:9222); don't spawn chromedriver.
  2) Never pass --user-agent (use --uxr-ua-*); it desyncs UA vs UA-Client-Hints.
  3) No puppeteer-stealth / undetected-chromedriver / JS fingerprint patches.
  4) Blocked ~90% = my IP (datacenter), not the fingerprint. Use a residential/mobile proxy, then retry.

Now walk me through launching Fortress and wiring my automation to it.
Full guide: https://github.com/tiliondev/fortress/blob/main/AGENTS.md

The Fortress MCP: stealth browsing as agent tools

Raw CDP is for code you write. The Fortress MCP is for agents that call tools: a Model Context Protocol server that hands Claude, Cursor, or any MCP client a stealth browser, so the moment a fetch is blocked it just calls a tool and gets the page. 29 tools, local and free: fetch_protected_page, extract_page, crawl_site, recon_site_apis, search_web, run_browser_task, save_profile, get_stealth_cdp_endpoint, and more.

_{Real, dated run against stockx.com (PerimeterX). A stock browser gets HTTP 403, “Access denied”; an agent with the Fortress MCP returns clean JSON from the same site and the same prompt. Reproduce it from the framework repo.}

Set it up in 30 seconds

Two runners; pick one. npx needs Python on PATH; pip installs it directly:

pip install "tilion[mcp]"      # command:  tilion-mcp
#   or, zero-install:
npx -y tilion-mcp              # auto-runs the server via uv (no global install)

Claude Desktop: Settings > Developer > Edit Config (claude_desktop_config.json):

{ "mcpServers": { "fortress": { "command": "tilion-mcp" } } }

_{For npx, use "command": "npx", "args": ["-y", "tilion-mcp"]. Restart Claude, and the fortress tools appear.}

Claude Code (CLI), one line:

claude mcp add fortress -- tilion-mcp          # or:  claude mcp add fortress -- npx -y tilion-mcp

Cursor (~/.cursor/mcp.json) · Cline / Windsurf (VS Code > MCP servers), same block:

{ "mcpServers": { "fortress": { "command": "tilion-mcp" } } }

Then ask your agent, “get the price off this StockX page”, and it calls fetch_protected_page on its own.

What the agent gets

Tools are annotated (reads auto-approve, writes gate), pre-warmed on startup (~100 ms first call), concurrency-safe, and timeout- and SSRF-guarded. A hosted endpoint with residential egress, Tilion Cloud, is on a waitlist at tilion.com.

Full 29-tool table, benchmarks, and the agent skill: mcp/

Why patch the engine, not the page

The usual approach patches navigator.webdriver, spoofs the WebGL vendor, and overrides navigator.plugins from script. CreepJS and similar detectors still flag it, and the reason is structural: a JavaScript spoof is a function standing where a native one belongs. Detectors set the returned value aside and interrogate whether the thing returning it is native:

Realm re-acquisition is the one that defeats every main-world patch. A detector grabs a pristine primitive from another realm and turns it on your function:

const iframe = document.createElement('iframe'); document.body.appendChild(iframe);
const realToString = iframe.contentWindow.Function.prototype.toString;
realToString.call(navigator.__lookupGetter__('vendor')); // returns your source code. Caught.

Your main-world patch lives in a different realm from that iframe. The same trap fires from a Web Worker, a thread your main-thread shim runs beside rather than inside.

Fortress has no such layer. The getter for navigator.vendor is the C++ getter: it reports [native code] because it is native code, identical across every realm. Camoufox puts it well: "there is no JavaScript hijacking to be detected." Fortress applies the same idea to V8 and Blink in place of Gecko, and, unlike a Firefox fork, emits a Chromium/V8 fingerprint that matches a Chrome user-agent by construction.

The four layers of bot detection, and where Fortress fits

Modern anti-bots (Cloudflare, DataDome, Kasada, HUMAN, Akamai) read structurally different surfaces in separate places. One tool rarely fixes all of them:

Layer	The tells	Where the fix lives	Fortress
A: driver / binary artifacts	cdc_ ChromeDriver vars, WebDriver protocol surface	Drive raw CDP, skip chromedriver	built to be driven this way
B: CDP side-effects	Runtime.enable leaks via sourceURL + init-script footprints, however clean the binary is	The control / CDP-client layer: hold back Runtime.enable, use Runtime.addBinding + isolated worlds	no leak (verified on rebrowser)
C: fingerprint surface	canvas, WebGL, WebGPU, audio, fonts, navigator, across main frame, iframes, workers	The engine (C++), because JS overrides self-reveal	this is Fortress
D: network / IP egress	datacenter ASN, IP reputation, geo-vs-persona mismatch	Your proxies (residential / mobile), or the Tilion hosted version	bring your own with the self-hosted engine; available on the Tilion hosted version, waitlist at tilion.com

Fortress is the Layer-C engine, built to be driven so A and B hold too, and to stay geo-coherent (timezone, locale and WebRTC follow the egress) once you supply a Layer-D IP. The binary alone leaves the CDP channel open and the IP question unanswered.

How Fortress compares

	Stock Playwright	puppeteer-extra-stealth	undetected-chromedriver	Camoufox	Antidetect apps¹	Fortress v3
Spoof layer	none	JS injection	CDP/config patch	C++ engine (Firefox)	C++ engine	C++ engine (Chromium)
toString yields [native code]	n/a		n/a
Survives realm re-acquisition (iframe/worker)
No Runtime.enable leak
Engine = Chrome / V8 (majority traffic)				Firefox
Coherent Chromium TLS shape				Firefox
Parameter-level WebGL + WebGPU coherence	n/a			no WebGPU	varies
Per-launch fleet dynamism (distinct machine)					persistent by design	48/48
Full-persona re-key on snapshot resume						on_restore
Native single-surface C++ patch engine	n/a	n/a	n/a		closed	81 patches
States its own limits	n/a	n/a	n/a

_{¹ Multilogin / GoLogin / Dolphin / Nstbrowser: closed-source engine patches, persistent identity by design, bundled residential egress (their Layer-D advantage over Fortress).}

Fortress builds on real prior art: fingerprint-chromium, ChromiumFish, and CloakBrowser came first, and commercial vendors recompile Chromium behind closed source. Native per-surface control is not unique to Fortress: Camoufox, Multilogin, GoLogin and Dolphin all patch engine C++.

Honest positioning. Fortress's real edge is the combination: the broadest native per-surface set on a Chromium base, fleet dynamism plus on_restore re-identity that no competitor matches, and coherence discipline (gated, byte-exact, parameter-level). Where Fortress is behind: IP egress (bring your own; the #1 real-world blocker) and behavioral humanization (mouse motion shipped; keystroke and scroll variance next).

v2 to v3 at a glance

v2 is the published Chromium-151/152 engine: a coherent single persona, command-line personas, renderer-string-only WebGL. v3 is the current build. The difference is 87 commits:

Proof: live-detector results

Reproduce any row with tools/gauntlet.py --bundle ./fortress-v153. Verified against live detectors; re-run dated in docs/GAUNTLET_RESULTS.md.

Real capture of the v3 binary (Chromium 153) run headless from a datacenter IP. Persona on this launch: Win32 · Chrome/153 · WebGL ANGLE (Intel HD Graphics Family, Direct3D11) · Europe/Rome · it-IT · 2-core / 16 GB, and a different coherent machine on the next launch (NVIDIA/Copenhagen, AMD, Apple…). That per-launch distinctness is the point; see Every session a distinct machine.

   

Benchmark: 92 protected sites, eight stacks

Method, target list and checker probes in docs/BENCHMARK.md. Run on 2026-09-28 from US-East cloud machines on datacenter IPs with no proxies. Every tool ran headless.

Fortress (build v153.0.8010.36-linux-3) and seven other browser stacks loaded 92 protected sites: Cloudflare, DataDome, Akamai, HUMAN, Kasada, Imperva, AWS WAF, Arkose, reCAPTCHA, twenty login pages and five controls. Every tool loaded every target twice, each time on a new cloud machine that was destroyed afterwards (1,584 machines, 1,472 scored runs). A run counts as served only if the real page loaded with no challenge or deny page showing. No clicks, no typing, no captcha solver. Fortress was driven through Tilion.fetch, the same call the MCP tool uses.

The range is the 95% Wilson interval. Fortress's interval does not overlap the next stack's. Fortress got 2/2 on ten sites where neither Camoufox nor puppeteer-stealth got more than 1/2 (WSJ, Marriott, Macy's, easyJet, PayPal sign-in, Tripadvisor, Monster, Zoopla, datadome.co, AutoZone); there is no site where Fortress got 0/2 and either of them got 2/2. nodriver, undetected-chromedriver and patchright served 62 to 66 pages, the same range as stock Chrome; run headless, all three send HeadlessChrome/153 in the user agent. Fortress's failure rate (13.6%) is about half of Camoufox's (25.5%) and one fifth of the Chrome-based tools' (64 to 66%).

Configure the persona

The binary carries zero brand strings. The launcher mints a coherent persona and delivers it to the renderer over IPC: no command-line footprint, per-context isolation, a different coherent machine on every launch. Any surface can still be pinned or overridden with --uxr-* switches, or set TILION_NO_DEFAULTS=1 for a bare launch.

--uxr-platform / --uxr-ua-platform / --uxr-ua-os / --uxr-ua-arch / --uxr-ua-bitness
--uxr-ua-platform-version / --uxr-ua-brand / --uxr-hw-concurrency / --uxr-device-memory
--uxr-webgl-vendor / --uxr-webgl-renderer / --uxr-webgl-fullparams / --uxr-webgpu-vendor
--uxr-canvas-seed / --uxr-audio-seed / --uxr-timezone / --uxr-languages / --uxr-color-scheme
--uxr-screen-width / --uxr-screen-height / --uxr-webrtc-policy=disable_non_proxied_udp

Full config reference: docs/UXR_CONFIG.md, every --uxr-* flag, every env var, and the coherence rules the engine enforces.

Works with your stack

Fortress exposes raw CDP on :9222, so it drops in under anything that speaks Playwright, Puppeteer, or CDP. Keep your framework, swap the browser.

from playwright.sync_api import sync_playwright
with sync_playwright() as p:
    browser = p.chromium.connect_over_cdp("http://localhost:9222")   # Fortress under the hood

Build & verify

Build from source

export CHROMIUM_VERSION=$(cat CHROMIUM_VERSION)   # 153.0.8010.36
build/build.sh                         # depot_tools, sync the tag, apply patches, gn gen, ninja
build/rebase-monthly.sh 154.0.XXXX.0   # bump + 3-way apply + rebuild + gauntlet-gate

Output: out/Fortress/chrome. The fork is 81 single-surface patches; the gauntlet gates every release on any regression. Cross-platform builds cross-compile from the same patched tree; v8 and boringssl carry their own sub-repo patches, applied separately. The first-generation patch series is public and rebuilds with the same script.

Platform	Status
Linux x64 (native) · Windows x64 (native .zip + launcher) · any OS via Docker	shipping
Linux arm64 · x86 · armhf (native tarball)	rolling out
macOS .app (arm64 / x64)	build from source
Code-signed installers	in progress

Verify it is ours

Fortress ships from four official channels. Treat anything else as untrusted:

Verify a download. Every release ships SHA256SUMS, and the pip/npm SDKs run this for you on install:

BASE=https://github.com/tiliondev/fortress/releases/download/v153.0.8010.36
curl -LO $BASE/fortress-v153-linux-x64.tar.gz
curl -Ls $BASE/SHA256SUMS | sha256sum -c --ignore-missing     # -> OK

Verify the Docker image by digest; a tag alone proves nothing:

docker pull tilion/fortress:153.0.8010.36
docker inspect --format '{{index .RepoDigests 0}}' tilion/fortress:153.0.8010.36
# compare the printed sha256:... against the digest in the GitHub Release notes

Reference

patches/     the first-generation C++ patch series (Fortress Source Available License 1.1)
build/       args.gn, build.sh, apply-patches.sh, rebase-monthly.sh, windows/, macos/
packaging/   tilion launcher, fonts.conf, Dockerfile, .deb + bundle builders
fonts/       222 metric-compatible OS-named font files (154 distinct families, incl. color emoji)
sdk/         python + node (tilion-fortress) prebuilt-binary SDKs
mcp/         the Fortress MCP server (29 tools) and the agent skill
tools/       gauntlet.py, the CreepJS / Sannysoft / BrowserScan CI gate
docs/        UXR_CONFIG (the --uxr-* reference), GAUNTLET_RESULTS, BENCHMARK

Contributing

Fortress does not accept outside pull requests; see CONTRIBUTING.md. If you find a detection vector or a leak we missed, email team@tilion.dev with a reproducible test page; it becomes the next patch.

License

Fortress Source Available License 1.1. The Fortress patches, SDK, MCP server, launcher and tooling are source-available: free to read, modify, rebuild, redistribute, and to use for development, testing and evaluation at any size. Production use is free for individuals and for organizations under US$500,000 in cumulative funding and US$300,000 or less in ARR; other organizations need one flat subscription, bought self-serve (see LICENSE and SUBSCRIPTION-TERMS.md). Earlier BSD-licensed releases keep their BSD permissions (LICENSE-BSD-LEGACY). Chromium and the bundled fonts retain their own licenses; see NOTICE.