Changelog

The API blocks any Single or Browser request whose target URL, follow-redirect chain, or proxy field resolves to a private or reserved IP range. Even if a public target redirects into an internal network, the request stops before it gets there.

The Overview page now shows a Credits panel with your total credits used plus a per-product breakdown (Single, Proxy, Browser). Big numbers stay compact (like 29.7M) and hovering reveals the exact value. Respects your active filters and time range.

If you passed a negative validate to /api/auto (like {data: {fail: ['"Due to legal reasons"']}}), a Cloudflare 'Just a moment' interstitial could slip through as a cached success because the fail-list didn't happen to match its text. Auto now rejects challenge pages before applying your validate rules, and it swaps the bad exit and re-solves instead of scoring it.

There's now a dedicated home for the FourA MCP Server at foura.ai/mcp. Pick your client (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, or the hosted remote server), copy the config, or install with one click through the Add-to-Cursor and Install-in-VS-Code deeplinks. Four tools ship with it: foura_auto, foura_single, foura_proxy, and foura_browser.

Some targets only respond to specific countries (regional sportsbooks, marketplaces with geo restrictions). Auto now notices when a site is geo-gated, remembers which countries return real responses, and pulls fresh exits from those countries on later calls. Concurrent load also spreads across the allowed set, so one exit doesn't take the whole load and get rate-limited.

If you set a long timeout on foura_auto through the hosted MCP server, the request could time out at the edge before your call finished. That's fixed. Full-budget auto calls now run their 180-second budget end to end.

If you've been hitting 429s when firing many concurrent Auto calls at one target, those calls used to funnel onto a single cached exit because the warm path picked the score-favourite and replayed once. Auto now opens additional sessions on demand and routes each call to the least-loaded exit, so a burst fans out across multiple proxy IDs instead of hammering one. Measured locally: a 100-call burst on a no-cookie portable host now spreads across the grown pool within seconds.

The language switcher across the main site, blog, docs, and Updates portal got an overhaul. Each option shows the language's native name plus its name in your current UI language (so 'Deutsch · немски' on the Bulgarian site), with a search box that filters all 13 locales by name, code, or locale id. Each option is now a real link with hreflang, so search engines and AI crawlers can follow every translation, and you can cmd-click to open another language in a new tab. The switcher also lives in the footer of every site.

Cloudflare injects a passive script even on pages that pass cleanly, and Auto used to treat any reference to it as an active challenge and run a full browser solve anyway. Now only true interstitial markers (the 'just a moment' page and friends) trigger the browser path; a clean 200 comes back from the cheaper proxy rung. Auto also follows up to 5 redirects by default (configurable via followRedirects).

The API Playground in your Dashboard now has Auto as a top-level Mode, alongside the Product row (Single, Browser, Proxy Finder). You can try the cost-aware ladder and session amortization end-to-end, set timeout_ms for the total budget, and pass ignoreProxies directly from the UI. Picking Auto switches off the per-product engines and vice versa.

Two controls from the per-product endpoints landed on Auto. timeout_ms (5s to 180s, default 120s) is now the total budget for the whole call; the orchestrator portions it across internal rungs so one sub-call can't eat your entire window. ignoreProxies lets you pass a list of proxy IDs Auto should skip, honoured across warm sessions, the good-exit probe, and the new-exit search.

Auto used to ratchet a host's session TTL downward on every replay failure, even when the failure didn't reflect a real cookie expiry. Sessions kept getting evicted and re-solved while their cookies still worked. The TTL now grows on aged successes and only retreats on real expirations, so a learned session for a Cloudflare-cleared host can carry across several minutes instead of dying after the first 403.

When a Cloudflare-protected target served a real geo-block page (451) after the challenge passed, the Browser product was reporting it as a 200 because the watcher hardcoded the cleared status. The watcher now reads the actual post-clearance Document, so a 200 stays 200, a 451 surfaces as 451, and Auto rejects the wrong content and keeps searching for an exit that genuinely matches your validate rules.

Auto sessions now adapt to what each target needs. Sites without interactive challenges run as portable sessions where cookies ride the proxy pool, so rotation and failover come automatically. Sites that bind their unlock to one exit (interactive Cloudflare being the main one) get pinned with a per-clearance concurrency cap, so a burst of replays can't burn through your unlock.

We tightened proxy redaction in stored request payloads. Before, an internal upstream proxy address could leak into the Activity log preview when the original request was mutated for forwarding. Now any raw proxy URL in a stored payload is replaced with the opaque proxy ID (or with [redacted-proxy] if there's no ID to restore). The visible response was already opaque; this closes the same loop on the request preview.