Cloudflare logo with orange cloud, illustrating a FreeAnswers guide to Cloudflare Kitesurf, the open source browser for AI agents

Cloudflare Kitesurf: Power-User Guide to Self-Hosting, Browser Run and Limits

by

Last updated: November 14, 2026

Cloudflare Kitesurf, the company’s lightweight browser engine for AI agents, became open source under Apache 2.0 on November 12 and 13, 2026. You can now run it locally, connect Puppeteer or an MCP-based agent over the Chrome DevTools Protocol, and deploy your own copy to Cloudflare Workers.

This guide is based on Cloudflare’s open source announcement, the developer changelog entry, the Kitesurf GitHub repository and the Browser Run Kitesurf documentation.

Contents

What changed

Cloudflare introduced Kitesurf in August as a stateless browser for AI agents on its Browser Run service, and added WebMCP support and new APIs in September. Until now, you could only use the hosted version.

The changelog entry dated November 12, 2026 says Kitesurf is now open source on GitHub under the Apache 2.0 license. You can inspect the source, run it locally and deploy an instance to your own Cloudflare account. The blog post followed on November 13.

Cloudflare is clear that the project is still experimental and under heavy development. Its current focus is web standards compatibility, reliability and efficiency.

How Kitesurf works

Kitesurf runs entirely on Cloudflare Workers. It parses HTML, applies CSS, runs page JavaScript and renders screenshots without Chrome or a browser container. Because it speaks the Chrome DevTools Protocol (CDP), existing tools such as Puppeteer can drive it.

The announcement describes three main parts: the Engine manages browser sessions and client connections, PageScript runs the page and its JavaScript, and PageRenderer draws the result. It builds on open source Rust projects compiled to WebAssembly:

  • Blitz for HTML parsing, the DOM, layout and painting
  • Stylo for CSS parsing and computed styles
  • Boa for JavaScript inside WebAssembly, used only as a last resort when JavaScript cannot run in Dynamic Workers
  • Linebender libraries for text layout and 2D graphics, and Krilla for PDF output

The repository also includes a terminal client, kitesurf-cli. The Kitesurf site says it can be installed with Homebrew and shows pages with kitty graphics where supported.

How to run Kitesurf locally

The README lists these requirements: Bazelisk installed as bazel, Node.js 22 or newer, pnpm 9.15.4, and GNU tar on macOS. Rust through rustup is needed only if you edit the vendored crate patches.

  1. Install pnpm if needed: npm install --global pnpm@9.15.4.
  2. Clone the repository: git clone https://github.com/cloudflare/kitesurf.git, then cd kitesurf.
  3. Install dependencies: pnpm install --frozen-lockfile.
  4. Build and start the engine: pnpm run dev. The first build compiles the Rust core and takes a while; later builds reuse the Bazel cache.
  5. Check that it is running: open http://127.0.0.1:8787/health. Set KITESURF_PORT=8799 before the command if port 8787 is taken.
  6. Inspect a page: open http://127.0.0.1:8787/?url=https://example.com in Chrome to load the page in DevTools.
  7. Connect Puppeteer: install puppeteer-core and call puppeteer.connect() with browserWSEndpoint: "ws://127.0.0.1:8787/devtools/browser". HTTP discovery is at /json/version.

Cloudflare’s blog also suggests pointing an AI coding agent at the local CDP port. If you already use agent tools such as Browser Use 1.0, a local Kitesurf endpoint is a low-cost target to test against.

Deploying your own instance safely

Run pnpm run deploy from the repository root to build with Bazel and upload with Wrangler. A Workers Paid plan is required, because Kitesurf uses Dynamic Workers to start an isolated Worker for each page and renderer.

The README carries a strong warning: the engine has no authentication of its own. Anyone with the URL can browse through your engine, connect CDP clients, send requests from your account and use CPU time you pay for. The default workers.dev address is public and follows a predictable pattern.

  • Turn on Cloudflare Access for all Workers in the account before deploying, so there is no public gap.
  • For Puppeteer behind Access, create an Access service token, allow it with a Service Auth policy, and send CF-Access-Client-Id and CF-Access-Client-Secret headers.
  • Use pnpm run deploy --dry-run to build without uploading, or pnpm run deploy:preview to upload a version without sending traffic. Version URLs are public too, so protect them as well.

Using Kitesurf on Browser Run

If you do not need to self-host, the Browser Run documentation (updated November 13, 2026) says the managed Kitesurf is in beta and free, behind per-account limits. You opt in per request:

Method How to select Kitesurf
Quick Actions (screenshot, content, PDF) Add ?browser=kitesurf to the endpoint
Workers browser binding Pass browser: "kitesurf" to quickAction(); set "remote": true for local development
CDP (Puppeteer, Playwright) Add browser=kitesurf to the /browser-run/devtools/browser WebSocket URL
MCP clients Run chrome-devtools-mcp with that WebSocket URL and a Browser Run API token
WebMCP Use the same CDP URL; no lab session needed, and keep_alive is not accepted

The WebMCP documentation adds that Kitesurf supports declarative form tools. The same MCP setup pattern works in harnesses such as OpenCode and Claude Code, whose new scripted tool calls are covered in our Claude Code Code Mode guide.

Kitesurf vs. Chromium

Cloudflare compared Kitesurf with a warm Chromium pool using medians of five Quick Action runs across 14 URLs. These are Cloudflare’s own figures:

Metric Kitesurf Chromium (warm pool)
CPU, screenshot 380 ms 1,173 ms
CPU, HTML extraction 229 ms 877 ms
Memory, screenshot 57.8 MiB 271.0 MiB
Memory, HTML extraction 39.4 MiB 273.7 MiB
Wall time, screenshot 1,148 ms 637 ms
Wall time, HTML extraction 820 ms 472 ms

In short, Kitesurf uses 3 to 7 times less CPU and memory but is slower in wall time. Cloudflare also reports that Kitesurf passes over 235,000 Web Platform Tests subtests, with 97% coverage for DOM and 96% for HTML, while noting that standards tests do not prove every real site will work.

Limits and things to watch

  • Not a full Chrome. No video or WebGL, no bot-challenge handshakes with real TLS fingerprints, and no long-running authenticated sessions with persistent state.
  • Partial DevTools support. Kitesurf provides a CDP endpoint, and some DevTools features do not work yet.
  • WebMCP gaps. No tools permissions policy or origin-based filtering, no tools from iframes or popups, and no live view for confirming tools that wait for a person.
  • Security is your job. A self-hosted engine is open to anyone with the URL until you add Access.

For another approach to agent automation, see our Antigravity Dynamic Workflows guide.

Frequently asked questions

Is Cloudflare Kitesurf open source?

Yes. Cloudflare published Kitesurf on GitHub under the Apache 2.0 license, announced in its changelog on November 12, 2026 and on its blog on November 13. You can read the code, run it locally, change it and deploy your own instance. Bundled fonts, data and dependencies keep their own licenses.

Is Kitesurf free to use?

The managed version on Cloudflare Browser Run is in beta and free, behind per-account limits. Running the open source engine locally with wrangler dev costs nothing, but deploying it to Cloudflare requires a Workers Paid plan because it uses Dynamic Workers.

Does Kitesurf work with Puppeteer and Playwright?

Kitesurf speaks the Chrome DevTools Protocol, so Puppeteer can connect to a local engine at ws://127.0.0.1:8787/devtools/browser. Cloudflare’s Browser Run documentation says existing Puppeteer, Playwright and chrome-remote-interface setups work with the managed endpoint when you add browser=kitesurf.

What can Kitesurf not do yet?

Cloudflare says Kitesurf cannot yet play video or render WebGL, pass bot challenges that check real TLS fingerprints, or keep long-running authenticated sessions with persistent state. For those cases, use Browser Run’s default Chromium browser.

Is Kitesurf faster than Chromium?

Not in wall time. In Cloudflare’s own Quick Action tests, Kitesurf used 3.1 to 7 times less CPU and memory than a warm Chromium pool, but took about 1.7 to 1.8 times longer to finish screenshots and HTML extraction.

Sources

Related answers

Leave a Comment