You know the feeling. You need data from a modern website—maybe for an AI training pipeline, a price tracker, or just a pet project. You fire up Playwright or Puppeteer. You watch your RAM usage spike to 500MB per page. The site loads, but then Cloudflare drops a CAPTCHA. You’re blocked. You try again. The page times out. Your laptop fan sounds like a jet engine.
We’ve been told this is the only way: run a full headless browser, act like a human, and hope for the best. It’s expensive, slow, and fragile. The future of web scraping isn’t about running bigger browsers. It’s about running none at all.
That’s the insight behind Draco, a new open-source scraper written in Rust. It doesn’t boot Chrome. It doesn’t render a single pixel. Instead, it mimics the network-level signature of a real browser—the TLS handshake, the JA4 fingerprint—and walks right past anti-bot walls. In benchmarks against Cloudflare and Target, Draco bypassed them in under a second using just 20MB of RAM. Playwright, by contrast, used 500MB and timed out.
This is a fundamentally different philosophy. Most scraping tools are fighting the wrong battle. They’re trying to act human when they should just act like a real connection. The web doesn’t care if you’re a person. It cares if your packet handshake looks legit.
Draco doesn’t stop there. It has a three-tier engine:
- Tier 1 (Stealth Fetch): Perfect TLS/JA4 spoofing. No browser needed. Works for 80% of sites.
- Tier 2 (V8 Isolate): When it hits a React or Next.js SPA, Draco spins up an in-process V8 engine in milliseconds. It hydrates the DOM, intercepts the hidden JSON APIs, and gives you the raw data. No graphical overhead.
- Tier 3 (Real Browser): If all else fails, it falls back to driving an actual browser on your machine. But you’ll rarely need it.
The result? Draco scores 769.7 on a benchmark of 8 tough sites—nearly double the nearest competitor. It passes every test. Playwright passes only 4 out of 8 and uses 2.5x more RAM.
I built this because I was tired of the racket. Hosted scraping APIs like Firecracker charge per page. Self-hosted headless Chrome farms eat your infrastructure budget. You’re paying for the illusion of ‘humanity’ when the real cost is in the rendering pipeline. Draco cuts that cost by 25x.
But the real twist? Draco is less human than any other tool, yet it bypasses anti-bot systems better. It doesn’t pretend to be a person. It pretends to be a real browser’s network stack. That’s a distinction most scraping tools miss.
It’s also a complete drop-in replacement for hosted services. Run draco serve and you get a Firecracker-compatible REST API. Built-in MCP server for Claude Desktop and AI agents. Parallel web search without a Google API key. Stateful page interaction. All in a single binary.
This is open source (MIT/Apache-2.0). Grab the binary. Point it at a difficult URL. Watch it work.
The cloud tax on web scraping is over. Stop renting browsers. Own your data pipeline.
Table: Draco vs. competitors (8-site benchmark, lower RAM is better)
| Rank | Tool | Score | Pass | Avg Time (s) | Avg RAM (MB) |
|---|---|---|---|---|---|
| #1 | Draco | 769.7 | 8/8 | 3.45 | 216.5 |
| #2 | Obscura | 384.5 | 4/8 | 2.68 | 87.59 |
| #3 | BrowserOxide | 373.4 | 4/8 | 6.42 | 105.95 |
| #4 | Playwright | 342.2 | 4/8 | 1.71 | 535.07 |
| #5 | Bouncy | 196.6 | 2/8 | 0.59 | 19.38 |
FAQ
Q: Does Draco work with heavy JavaScript SPAs like React or Next.js?
A: Yes. When Tier 1 (stealth fetch) fails, Draco uses an in-process V8 isolate to hydrate the DOM and intercept the JSON APIs the SPA calls. This avoids the overhead of a full browser while still rendering JavaScript.
Q: Can I use Draco as a drop-in replacement for Firecrawl or Browserbase?
A: Absolutely. Draco's daemon mode exposes a REST API that is compatible with the Firecrawl API. You can swap your API key, point it at your own server, and start self-hosting immediately. It also includes a built-in MCP server for AI agents.
Q: How does stealing TLS fingerprints compare to using a real browser? Isn't that less human?
A: Actually, anti-bot systems like Cloudflare primarily check the network handshake (TLS/JA4) before even looking at JavaScript behavior. If your handshake looks like a real browser's, you pass the first gate. Draco doesn't try to act human—it acts like a real browser's connection. That's more effective than running a full browser that might still fail the fingerprint check.