Goldfinch is a Chromium-based browser built on Electron — privacy by default, containerized identities, a media panel that catalogs the page, and an automation surface your AI agent can drive. One runtime dependency. No telemetry. MIT licensed.
Four independent strategies, each individually toggleable, applied automatically to every container, burner, and default tab the moment its session is created.
Cancels requests to known tracker and ad domains — analytics, ads, social pixels — classified by registrable domain.
Removes utm_*, fbclid, gclid, and 30+ other ad-click parameters from outgoing URLs; trims Referer to origin only.
Strips Cookie headers and drops Set-Cookie on all cross-site requests.
Per-session noise injected into Canvas, WebGL, and AudioContext APIs, plus navigator spoofing — every jar gets its own seed.
“The whole trust boundary fits in an afternoon of reading. That’s the feature.” Design principle — one runtime dependency
Each jar is its own session partition — separate cookies, storage, cache, and farble seed. New installs ship with Personal and Work; add your own from the jar management page.
Browsing history is recorded per jar with configurable retention (1–3650 days) and powers frecency-ranked address-bar suggestions — purely local, never suggested across jars.
A non-persistent partition that evaporates when the tab closes. No cookies, no storage, no history — nothing left behind.
One click wipes the jar's cookies and storage, rerolls its fingerprint seed, and reloads — the site can't link the new session to the old.
Confirm-gated clear cookies / site storage / cache, plus full identity wipe — from the goldfinch://jars management page.
Off by default. The Settings toggle is the sole bind gate, and it ships in the installed binary — a human turns it on, per-jar API keys authenticate every request, and the server binds to loopback only with Origin/Host pinned against DNS rebinding.
Drive (navigate, click, type, scroll, drag), observe (screenshot, DOM read, a11y tree), eval (evaluate, injectScript — zero CDP), DevTools, and jar-scoped history.
A jar key sees only its own jar's tabs and history. An env-gated admin tier adds chrome/app-level ops for dogfooding.
The getHistory tool gives an automation client read access to its own jar's browsing memory — the browser as a first-class MCP citizen.
Every authenticated request lands in an audit log, viewable in Settings. Activity indicator in the toolbar while any session is live.
Free, MIT, no account. Or build from source: npm install && npm start (Node ≥ 22).
| Platform | Installer | Alt |
|---|---|---|
| macOSApple Silicon | Goldfinch-0.10.4-arm64.dmg | .zip |
| Windowsx64 · NSIS | Goldfinch-Setup-0.10.4.exe | — |
| Linuxx64 | Goldfinch-0.10.4.AppImage | .deb |
Heads up: builds are currently unsigned — the first launch shows a Gatekeeper (macOS) / SmartScreen (Windows) warning; allow it through. macOS builds are Apple Silicon only for now.
Node ≥ 22, one install, one start. Electron does the rest.
Unit tests, typecheck, lint, and a live-app axe-core a11y gate.
Issues and PRs welcome. CI runs tests, typecheck, lint, and a package smoke-build on every PR.