Changelog

v0.5.0

• Serverless Functions (POST /v1/functions/invoke) — send code, get results. No session management needed
• Your code gets a page object with goto, evaluate, extract, screenshot, click, type — the full browser API
• Lazy CDP connection — functions that don't touch the browser run in ~130ms
• Per-command 30s timeout so nothing hangs forever
• SDK v0.5.0 — new invoke() method on both TypeScript and Python clients
• MCP server v0.3.0 — new invoke_function tool for Claude Desktop / Cursor / VS Code

• BrowserSession::Drop was calling waitpid() on tokio worker threads, blocking all HTTP responses. Moved to background thread
• Deno wrapper now force-exits after completion instead of hanging on WebSocket refs
• Internal wrapper debug logs filtered from API response

v0.4.0

• Sessions can now stay alive across disconnects (keep_alive: true)
• Configurable timeouts per session — default 5min, up to 24 hours
• Attach JSON metadata to sessions for tagging and filtering
• POST /v1/sessions/:id/keepalive to reset idle timer
• Network waterfall — see every HTTP request your session makes with status codes and timing
• Session recording via CDP screencast — frames captured on page changes
• POST /v1/fetch — grab page content with browser-like headers, no Chrome process needed
• POST /v1/sessions/:id/pdf — generate PDF of current page
• Per-user request log (GET /v1/logs) — last 100 API calls per key
• SDK v0.4.0 — keepalive(), network(), recording(), pdf(), fetch(), logs()
• MCP server v0.2.0 — added pdf, network, quick_fetch tools
• Changelog page at shadey.dev/changelog
• Dashboard now has Overview, Logs, and Settings tabs

• Warm pool sessions now clear cookies and state before reuse
• Bumped systemd TasksMax from 512 to 2048 (was causing server hangs under load)

v0.3.0

• MCP server (npx shadey-mcp) — works with Claude Desktop, Cursor, VS Code
• Interactive browser demo on landing page
• Webhooks with HMAC-SHA256 signed delivery (session.created, session.destroyed, session.error)
• Trust center page (shadey.dev/security)
• SLA page (shadey.dev/sla) — 99.9% uptime target
• Status page (status.shadey.dev) via Better Stack
• Email routing (security@, billing@, support@ forwarding)
• Dashboard tabs (Overview, Logs, Settings)
• 3-dot pulse loading animation for demos
• Lenis smooth scroll + GSAP scroll-triggered animations

• CDP port overflow (recycled ports instead of always incrementing)
• Chrome orphan processes (kill process group on Linux)
• SSRF bypass vectors (proper URL parsing, IPv6-mapped, decimal IPs)
• list_sessions BOLA leak (filter by API key)
• Dashboard showing infinity for free plan usage

• IP rate limiting (30 req/sec per IP)
• Global session cap (20 concurrent max)
• Request body size limit (256KB at Caddy + Axum)
• Stripe webhook signature verification

v0.2.0

• REST API endpoints (navigate, screenshot, extract, evaluate, content)
• Persistent browser profiles with fingerprint binding
• Warm session pool (sub-1s session creation)
• TypeScript SDK v0.3.0 on npm (npm install shadey-sdk)
• Python SDK built (goto, screenshot, extract, evaluate, content)
• Stripe metered billing ($0.08/min) with webhook handler
• GitHub profile scraper demo on landing page
• Docs site at docs.shadey.dev

• Landing page redesign: warm color palette, perceptual depth, 3D text shadows

v0.1.0

• Stealth engine: 72 fingerprint protections
• Behavioral engine: Hawkes process, HMM 5-state model, Fitts' law mouse, bigram keyboard
• CDP WebSocket proxy with Runtime.Enable/Debugger.Enable interception
• Session CRUD API (create, list, get, delete)
• Behavioral endpoint (click, type, scroll, idle, dwell)
• API key auth (Argon2id + SQLCipher)
• Ad blocking (10 filter lists, 140K rules)
• Deployed to Hetzner AX42-U
• Landing page at shadey.dev
• 100% anti-bot pass rate (Cloudflare, DataDome, PerimeterX, Kasada)