Cloudflare has open-sourced Kitesurf, its browser engine for artificial intelligence agents, on GitHub under the Apache 2.0 license. Developers can inspect it, run it locally, modify it, and deploy their own instance on Cloudflare Workers.
A browser without a browser container
Kitesurf runs entirely on Cloudflare Workers: it parses HTML, applies CSS, executes page JavaScript, and generates screenshots without relying on a browser container. It also implements Chrome DevTools Protocol (CDP), so it can connect to compatible tools such as Puppeteer.
Cloudflare presents it as a lightweight alternative for agents that need to load sites, execute page code, and interact with them. The company says it aims to use less CPU and memory than a full browser such as Chromium, while scaling on demand through its global Workers network. The open-source announcement does not include a new performance measurement.
The engine integrates with Browser Run, Cloudflare's managed APIs, but the repository lets each team run its own instance. In August, when it introduced Kitesurf, the company said the service was free during the beta and that, for common agent tasks—such as taking screenshots and extracting HTML—it used between three and seven times less CPU and memory than Chromium. That comparison refers to the initial announcement.
From beta to public repository
Cloudflare introduced Kitesurf in August as a stateless, scalable browser designed for agents from the outset. In September, it added WebMCP compatibility and new APIs, along with compatibility improvements. The company had announced then that it planned to let developers run the engine in their own accounts; it has now published the repository under the Apache 2.0 license.
Open-sourcing it enables inspection, modifications, and self-hosted deployments, but does not turn the project into a finished browser. Cloudflare describes it as experimental and under active development. The documentation says the team is working on web standards compatibility, rendering fidelity, and performance; the blog also lists reliability as a goal.
The repository has 892 stars and 35 forks on GitHub, according to the page consulted. These figures describe the project's visible activity, not an assessment of its maturity or compatibility with specific sites.
Rust, WebAssembly, and three main components
The implementation combines Cloudflare's development platform with Rust projects compiled to WebAssembly. Blitz handles HTML parsing, the DOM, layout, and painting; Stylo processes CSS, its cascade, and computed styles. Boa runs JavaScript in WebAssembly as a last resort when JavaScript cannot be used in Dynamic Workers.
For text and 2D graphics, Kitesurf uses Linebender libraries; Krilla generates PDF output. These projects retain their own licenses, and the repository's NOTICE file collects third-party notices. The main project is licensed under Apache 2.0, but that does not mean all included components have the same license.
At the engine level, Engine, PageScript, and PageRenderer make up its three main parts. Engine manages browser sessions and client connections; PageScript runs the page and its JavaScript; PageRenderer draws the result. The repository distributes these components and other packages—such as the Rust core, DOM layers, and terminal interface—in separate folders.
Run it locally and connect it with Puppeteer
To try Kitesurf locally, Cloudflare says you first need to meet the build requirements, clone the repository, and install the dependencies. Then, pnpm run dev builds the engine and starts Wrangler. The first build takes longer because it compiles the Rust core and its dependencies; subsequent builds reuse the cache.
The local server listens on 127.0.0.1:8787 by default. You can open a page in Chrome DevTools to inspect it, or a client can connect to the CDP endpoint. GitHub also documents a health check at /health and lets you change the port using the KITESURF_PORT variable if the default is already in use.
Puppeteer connects through a CDP WebSocket. Once connected, the client can open a page, navigate to a URL, and request a screenshot. CDP compatibility does not mean it is a complete implementation of Chrome: the repository warns that some Chrome DevTools features do not yet work.
The GitHub documentation details the build requirements: Bazelisk installed as bazel, Node.js 22 or later, and pnpm 9.15.4, the version pinned by the repository. On macOS, GNU tar is required. Rust via rustup is only needed to edit patches to vendored dependencies. Bazel downloads the pinned versions of Bazel, Rust, wasm-bindgen, and Binaryen itself.
Deployment requires securing the instance
To deploy Kitesurf to your own account, run pnpm run deploy from the repository root. The operation requires a Workers Paid plan: the engine uses Dynamic Workers to create isolated instances for pages. Deployment builds the engine with Bazel and uploads it through Wrangler.
The most important warning concerns operational security: Kitesurf does not include authentication. Cloudflare recommends protecting the URL with Cloudflare Access or another authentication layer. The workers.dev address is public by default and follows a predictable pattern: kitesurf.<subdomain>.workers.dev.
Without protection, anyone who knows the address can open DevTools and browse through the engine, connect with Puppeteer or other CDP clients, send outbound requests from the Cloudflare account, and consume CPU and Dynamic Workers billed to that account. In addition, there may be a public interval between the Worker being published and Access being enabled; the documentation recommends enabling Access for all Workers in the account before deployment to prevent this.
Access also affects automated connections. To connect Puppeteer through this layer, the documentation says to create a service token, authorize it with a Service Auth policy, and send its headers in the WebSocket connection. Cloudflare warns that the token must be kept secret because it grants the same access as an authenticated user.
Contributions with a focused scope
Cloudflare welcomes contributions, but warns that its review capacity is limited. It asks contributors to read the guidelines, open an issue first, and get approval from a maintainer before submitting a pull request. The team says focused fixes with tests, clear evidence, and a well-defined scope are easier to review.
Not everything has to be code: the company also suggests contributing a minimal page that reproduces a rendering bug, an automation flow that fails, or a clear documentation correction. To follow the work, it points to Web Platform Tests and the benchmarks, as well as the official website and changelog. Compatibility, reliability, and performance remain the stated areas of work.
Cloudflare does not announce a date for leaving the experimental phase in this post. For now, Kitesurf is available on GitHub for anyone who wants to try it, modify it, or deploy it, provided authentication is configured before exposing the Worker.
Sources: Cloudflare Blog, Cloudflare Docs, GitHub, Cloudflare Docs
