wafer-py
Anti-detection HTTP client for Python
Decision gist · record as of 2026-08-14
Yes, with conditions. Install if you need to bypass WAF detection and accept the experimental status—the package is actively maintained, has no known vulnerabilities, and low install friction. Do not install for production systems without thorough testing; the authors explicitly warn against production use and expect breaking changes. Suitable for development, testing, and research on protected endpoints.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.12 or later; wreq (the underlying Rust + BoringSSL HTTP library) is a compiled dependency bundled in the wheel.
- Low install friction—a pure Python wheel with a single runtime dependency (wreq).
- Actively maintained with a recent release (4 days old) and no known vulnerabilities, though the project explicitly states it is experimental and not intended for production use.
License · maintenance · safety
Apache-2.0 (permissive) — Apache-2.0 (permissive): you can use, modify, and distribute this package freely in commercial and private projects, provided you include a copy of the license and note any changes you make.
last release 2026-08-10 (4 days) · last repo commit 2026-08-10 · 7 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 213,759 downloads/mo, #9,430 on PyPI
Alternatives
Verify before relying
pip install wafer-py
import wafer
resp = wafer.get("https://example.com")
print(resp.status_code, resp.text)
with wafer.SyncSession() as session:
resp = session.get("https://example.com")
print(resp.json())- Stability and breaking-change frequency: the project is marked as experimental proof-of-concept; real-world production reliability is unclear.
- Performance characteristics under high concurrency or large response sizes compared to standard HTTP clients.
- Whether the WAF challenge solvers (ACW, Amazon, TMD, Reddit) remain effective as WAF vendors update their detection.
What it is and what it does
wafer-py is an HTTP client built on wreq (a Rust + BoringSSL library) designed to evade bot detection and WAF challenges. It handles TLS fingerprinting to mimic browser identities, detects and solves common WAF challenges, manages cookies with RFC 6265 scoping, retries failed requests with backoff, enforces rate limiting per hostname, and supports proxies and DNS pinning. It offers both synchronous and asynchronous session APIs, plus one-shot module-level convenience functions.
The package is explicitly experimental and not recommended for production. It targets developers building web scrapers, API clients, or tools that need to work around anti-bot protections. Responses expose a requests/httpx-compatible interface with metadata on retries, rotations, challenge types, and whether the body is a client-rendered shell. Configuration covers timeouts, retry limits, fingerprint pools, embed mode for iframe/XHR impersonation, and optional browser-based challenge solving.
Use it for
- Scrape websites protected by Cloudflare, AWS WAF, or other bot-detection layers without triggering blocks.
- Build a resilient API client that automatically rotates TLS fingerprints and solves WAF challenges on 403 responses.
- Test web applications' anti-bot defenses by simulating diverse browser fingerprints and handling challenge flows.
- Fetch data from sites that require cookie persistence and rate-limit compliance across multiple requests.
- Embed HTTP requests in iframe or XHR contexts to impersonate browser-initiated traffic.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, with conditions.
Install if you need to bypass WAF detection and accept the experimental status—the package is actively maintained, has no known vulnerabilities, and low install friction. Do not install for production systems without thorough testing; the authors explicitly warn against production use and expect breaking changes. Suitable for development, testing, and research on protected endpoints.
Install
wafer-py on PyPI
Before you install
Low install friction—a pure Python wheel with a single runtime dependency (wreq). Actively maintained with a recent release (4 days old) and no known vulnerabilities, though the project explicitly states it is experimental and not intended for production use.
Requires Python 3.12 or later; wreq (the underlying Rust + BoringSSL HTTP library) is a compiled dependency bundled in the wheel.
License in practice
Apache-2.0 (permissive): you can use, modify, and distribute this package freely in commercial and private projects, provided you include a copy of the license and note any changes you make.
Quickstart
pip install wafer-py
import wafer
resp = wafer.get("https://example.com")
print(resp.status_code, resp.text)
with wafer.SyncSession() as session:
resp = session.get("https://example.com")
print(resp.json())Verify before relying
- Stability and breaking-change frequency: the project is marked as experimental proof-of-concept; real-world production reliability is unclear.
- Performance characteristics under high concurrency or large response sizes compared to standard HTTP clients.
- Whether the WAF challenge solvers (ACW, Amazon, TMD, Reddit) remain effective as WAF vendors update their detection.
Package facts
| License | Apache-2.0 permissive |
| Python support | Supports the current Python release >=3.12 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagewreq |
| Maintenance | Actively maintained 4 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 213,759 / month, #9,430 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaIntended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Topic :: Internet :: WWW/HTTP |
Evidence: wafer_py-0.4.9-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “anti-detection http client”
- wafer-pyAn anti-detection HTTP client that handles TLS fingerprinting, WAF…
- fetch-useRoutes HTTP requests through Browser-Use's proxy infrastructure with…
- tls-clientAn HTTP client library that mimics the requests API but uses TLS…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also wreq · fetch-use · wrapper-tls-requests · rnet · curl-cffi · primp · wafw00f · cloakbrowser · browserforge · zenrows