{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "anchor-browser", "name": "Anchor Browser", "vendor": "Anchor Forge Inc.", "vendorUrl": "https://anchorbrowser.io", "kind": "http-api", "category": "browser", "summary": "Anchor Browser runs cloud browser sessions for AI agents, controlled through a REST API, a CDP WebSocket, TypeScript and Python SDKs and hosted MCP servers. It adds managed logins with MFA, profiles, proxies, CAPTCHA solving and recordings.", "url": "https://www.anchorterminal.com/tools/anchor-browser", "markdownUrl": "https://www.anchorterminal.com/tools/anchor-browser.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/anchor-browser.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/anchor-browser.json", "repo": "https://github.com/anchorbrowser/AnchorBrowser-SDK-Typescript", "license": "Proprietary cloud service. No service agreement was found, only a website terms of use. The TypeScript and Python SDKs and the self-hosted MCP server are Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://api.anchorbrowser.io", "packages": [ { "registry": "npm", "name": "anchorbrowser" }, { "registry": "pypi", "name": "anchorbrowser" } ], "auth": "mixed", "authNotes": "API key in the `anchor-api-key` header, created in the dashboard at app.anchorbrowser.io or issued by Agent Access, an unauthenticated puzzle flow that needs no account. The hosted MCP servers also accept OAuth sign-in through signin.anchorbrowser.io, with `mcp:tools` and `mcp:admin` scopes in the resource metadata. CDP connections pass the key as the `apiKey` query parameter on `wss://connect.anchorbrowser.io`. No key scopes, expiry or rotation guidance were found. Teams that enforce Agent Access identity also send `anchor-identity-token`.", "pricing": "freemium", "pricingNotes": "The Free plan has $5 of credits a month, and Agent Access gives an agent 1 credit with no account. Usage is $0.01 a browser created, $0.05 a browser-hour counted to the minute, $8 a GB through Anchor's proxy and $0.20 a GB otherwise. AI steps cost $0.01, $0.05 or $0.10 by model tier from 21 August 2026. Starter is $50 a month and Growth $2,000, with overage at $1 a credit. Enterprise is priced through sales (https://docs.anchorbrowser.io/pricing, checked 2026-10-08).", "priceSummary": "$0.01 / call", "where": "hosted", "x402": { "level": "no", "evidence": "A blog post dated 29 August 2025 shows x402 payment on POST https://api.anchorbrowser.io/v1/sessions and says it is enabled per project. An unpaid POST on 2026-10-08 returned 401 with no payment terms, and the docs and OpenAPI document describe `x402` only as a session option that lets the browser pay other sites through Amazon Bedrock AgentCore Payments.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 43004, "pypiWeekly": 10135, "asOf": "2026-10-08" }, "docsUrl": "https://docs.anchorbrowser.io", "llmsTxt": "https://docs.anchorbrowser.io/llms.txt", "openapi": "https://docs.anchorbrowser.io/openapi.yaml", "capabilities": [ "browser.control", "browser.hosted", "browser.debug", "web.fetch", "web.scrape", "scraping.proxies", "scraping.anti-bot", "pdf.generate" ], "tags": [ "official", "hosted", "freemium", "no-card", "openapi", "llms-txt", "mcp", "oauth", "python", "typescript", "proxies", "status-page", "soc2" ], "lastRelease": "2026-07-28", "graded": true, "anchor": { "graded": true, "score": 67.3, "grade": "B", "agentReady": false, "rank": 196, "ranked": true, "rankOf": 629, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 57, "payments": 60, "reliability": 80, "schema": 80, "security": 54, "transparency": 51 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 80, "points": 16, "reason": "Graded as a hosted service. status.anchorbrowser.io runs on incident.io with two components, Website and Anchor Application, and a calendar from July to October 2026 (20). Both show 100 per cent, and the incident feed and RSS are empty. The page has no API or browser component and has recorded no incident since it was set up in June 2025, so we award 25 of 30 for a clean record. Limits are published, 5, 25 and 100 session creations a minute and 5, 25 and 200 concurrent browsers by plan, and 2,000 requests a minute on Web Unlocker (15). The OpenAPI document declares 429 on ten operations, with `RateLimit` and `Retry-After` headers on session creation, and the Web Unlocker docs say to retry 429, 500, 503 and 504 with exponential backoff. No idempotency keys were found for writes (10). No SLA was found on the pricing page, the docs or the site (0). The API is version 1.0.0, the SDKs are 1.0 and nothing marks the sessions API as beta (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 80, "points": 13, "reason": "OpenAPI 3.1.0 at docs.anchorbrowser.io/openapi.yaml with 101 paths and 136 operations and the `anchor-api-key` header scheme (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). All 136 operations carry a description, the spec's introduction says which resource suits which job, and a docs page compares the task types. Few descriptions say when not to use an endpoint (16). Inputs are typed with 90 enum declarations and named request schemas. We did not audit every field for bounds (11). The spec holds 121 examples and declares 400, 401, 404 and 500 widely, with one shared error schema of `code` and `message` (12). Paths are versioned under /v1 and a legacy spec is kept. No API changelog was found, docs.anchorbrowser.io/changelog returns 404, and the SDK changelog stops at 1.0.0-dev.4 (6)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "The main MCP server lists about 24 tools and reaches the other REST routes through `list_endpoints`, `get_endpoint` and two call tools. Browser control and per-site actions are separate servers, and the docs warn that `/v1/mcp/actions` without a domain lists thousands of tools. 15 for the tool count plus 5 for the split servers (20). Session lists take `page`, `limit`, sort, search and filters by status, tag, domain and date, volumes use a cursor, and webhook deliveries take `limit` and `offset` (17). Errors return an integer code and a message, 402 marks exhausted credits, and Agent Access errors name the next call. No stable machine-readable error codes were found (13). No idempotency keys. The MCP server splits `call_endpoint_read` from `call_endpoint_write`, and batch sessions have a retry-failed call. Tool annotations were not read because the server needs a key (8). A session starts from an empty body, and the SDKs cover TypeScript and Python (15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 54, "points": 9.45, "reason": "API keys in the `anchor-api-key` header, per project. The MCP servers also accept OAuth through signin.anchorbrowser.io with `mcp:tools` and `mcp:admin` scopes. No key scopes, expiry or rotation guidance were found in the docs (22). The documented CDP connection passes the key as `apiKey` in the `wss://connect.anchorbrowser.io` URL, a secret in a query string (minus 10). No read-only API key. Live view has a read-only mode, volumes mount read-only, secrets can be limited to matching domains, identities sign in without returning credentials, and tasks can pause for a person's input (13). No prompt-injection guidance was found in the docs. Secret values and sensitive data masking keep credentials out of the model's view, which is a partial mitigation (4). Recordings, session history, webhook delivery logs and a billing endpoint give the operator a trail. The audit logs on the security page are restricted to Anchor's staff (11). SOC 2 Type 2, ISO 27001 and HIPAA per the security page and trust portal, with reports behind an access request, and a disclosure contact in the SDK's SECURITY.md. No security.txt or bug bounty was found (14)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "No machine payment protocol was confirmed on Anchor's own endpoints. A blog post dated 29 August 2025 shows x402 on `POST /v1/sessions`, but our unpaid request on 8 October 2026 returned 401 and the docs don't describe it. The session option named `x402` lets a browser pay other sites (0). Per-browser, per-hour, per-GB and per-step prices are published without login (20). The Free plan has $5 of credits a month, and Agent Access grants 1 credit with no account and no card. Whether dashboard signup asks for a card was not read (20). Agent Access issues an API key through two unauthenticated calls and a puzzle. `GET /v1/agent-access` answered with the flow on 8 October 2026. We did not complete it (20)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 57, "points": 4.99, "reason": "The newest dated releases are the TypeScript SDK 1.0.0 on npm on 26 July 2026 and the Python SDK 1.0.1 on PyPI on 28 July, 72 days before the check. The pricing page dates its AI step prices from 21 August 2026 (20). In the last 90 days we found one release, published as three packages over two days, and blog announcements without a readable year. No dated changelog (10). No public changelog. Support is by email, with Slack on Growth and above. GitHub issues were not read because the API refused us for its rate limit (5). Official SDKs for TypeScript and Python are current at 1.0. The MCP servers were not found in the MCP registry (15). The SDK repository has CI and publish workflows whose results we did not read, and the self-hosted MCP server's last commit is 24 July 2025 (7)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 51, "points": 4.46, "note": "editorial 40, provenance 61", "reason": "The service is closed. The SDKs and the self-hosted MCP server are Apache-2.0. The only terms published are a website terms of use dated 16 March 2025, which grants personal, non-commercial use of the site and does not cover the API, so the terms for the paid service are unclear (8). The security page says session data is not stored and each browser's virtual machine is destroyed, the pricing page gives 7 days of data retention, recordings are on by default, and Zero Data Retention is by request. The privacy policy (24 February 2026) covers the website and customer contacts, with one product section on Gmail access. The DPA and data handling policy sit behind an access request (15). The legacy tasks API and the old MCP address are labelled and still work, and the SDK has a migration guide. No deprecation policy or dates (5). The security page names AWS us-east-2 and eu-central-1. The trust portal has a subprocessor section, of which our reader saw only OpenAI and Anthropic (12)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "The main MCP server lists about 24 tools and reaches the other REST routes through `list_endpoints`, `get_endpoint` and two call tools. Browser control and per-site actions are separate servers, and the docs warn that `/v1/mcp/actions` without a domain lists thousands of tools. 15 for the tool count plus 5 for the split servers (20). Session lists take `page`, `limit`, sort, search and filters by status, tag, domain and date, volumes use a cursor, and webhook deliveries take `limit` and `offset` (17). Errors return an integer code and a message, 402 marks exhausted credits, and Agent Access errors name the next call. No stable machine-readable error codes were found (13). No idempotency keys. The MCP server splits `call_endpoint_read` from `call_endpoint_write`, and batch sessions have a retry-failed call. Tool annotations were not read because the server needs a key (8). A session starts from an empty body, and the SDKs cover TypeScript and Python (15).", "maintenance": "The newest dated releases are the TypeScript SDK 1.0.0 on npm on 26 July 2026 and the Python SDK 1.0.1 on PyPI on 28 July, 72 days before the check. The pricing page dates its AI step prices from 21 August 2026 (20). In the last 90 days we found one release, published as three packages over two days, and blog announcements without a readable year. No dated changelog (10). No public changelog. Support is by email, with Slack on Growth and above. GitHub issues were not read because the API refused us for its rate limit (5). Official SDKs for TypeScript and Python are current at 1.0. The MCP servers were not found in the MCP registry (15). The SDK repository has CI and publish workflows whose results we did not read, and the self-hosted MCP server's last commit is 24 July 2025 (7).", "payments": "No machine payment protocol was confirmed on Anchor's own endpoints. A blog post dated 29 August 2025 shows x402 on `POST /v1/sessions`, but our unpaid request on 8 October 2026 returned 401 and the docs don't describe it. The session option named `x402` lets a browser pay other sites (0). Per-browser, per-hour, per-GB and per-step prices are published without login (20). The Free plan has $5 of credits a month, and Agent Access grants 1 credit with no account and no card. Whether dashboard signup asks for a card was not read (20). Agent Access issues an API key through two unauthenticated calls and a puzzle. `GET /v1/agent-access` answered with the flow on 8 October 2026. We did not complete it (20).", "reliability": "Graded as a hosted service. status.anchorbrowser.io runs on incident.io with two components, Website and Anchor Application, and a calendar from July to October 2026 (20). Both show 100 per cent, and the incident feed and RSS are empty. The page has no API or browser component and has recorded no incident since it was set up in June 2025, so we award 25 of 30 for a clean record. Limits are published, 5, 25 and 100 session creations a minute and 5, 25 and 200 concurrent browsers by plan, and 2,000 requests a minute on Web Unlocker (15). The OpenAPI document declares 429 on ten operations, with `RateLimit` and `Retry-After` headers on session creation, and the Web Unlocker docs say to retry 429, 500, 503 and 504 with exponential backoff. No idempotency keys were found for writes (10). No SLA was found on the pricing page, the docs or the site (0). The API is version 1.0.0, the SDKs are 1.0 and nothing marks the sessions API as beta (10).", "schema": "OpenAPI 3.1.0 at docs.anchorbrowser.io/openapi.yaml with 101 paths and 136 operations and the `anchor-api-key` header scheme (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). All 136 operations carry a description, the spec's introduction says which resource suits which job, and a docs page compares the task types. Few descriptions say when not to use an endpoint (16). Inputs are typed with 90 enum declarations and named request schemas. We did not audit every field for bounds (11). The spec holds 121 examples and declares 400, 401, 404 and 500 widely, with one shared error schema of `code` and `message` (12). Paths are versioned under /v1 and a legacy spec is kept. No API changelog was found, docs.anchorbrowser.io/changelog returns 404, and the SDK changelog stops at 1.0.0-dev.4 (6).", "security": "API keys in the `anchor-api-key` header, per project. The MCP servers also accept OAuth through signin.anchorbrowser.io with `mcp:tools` and `mcp:admin` scopes. No key scopes, expiry or rotation guidance were found in the docs (22). The documented CDP connection passes the key as `apiKey` in the `wss://connect.anchorbrowser.io` URL, a secret in a query string (minus 10). No read-only API key. Live view has a read-only mode, volumes mount read-only, secrets can be limited to matching domains, identities sign in without returning credentials, and tasks can pause for a person's input (13). No prompt-injection guidance was found in the docs. Secret values and sensitive data masking keep credentials out of the model's view, which is a partial mitigation (4). Recordings, session history, webhook delivery logs and a billing endpoint give the operator a trail. The audit logs on the security page are restricted to Anchor's staff (11). SOC 2 Type 2, ISO 27001 and HIPAA per the security page and trust portal, with reports behind an access request, and a disclosure contact in the SDK's SECURITY.md. No security.txt or bug bounty was found (14).", "transparency": "The service is closed. The SDKs and the self-hosted MCP server are Apache-2.0. The only terms published are a website terms of use dated 16 March 2025, which grants personal, non-commercial use of the site and does not cover the API, so the terms for the paid service are unclear (8). The security page says session data is not stored and each browser's virtual machine is destroyed, the pricing page gives 7 days of data retention, recordings are on by default, and Zero Data Retention is by request. The privacy policy (24 February 2026) covers the website and customer contacts, with one product section on Gmail access. The DPA and data handling policy sit behind an access request (15). The legacy tasks API and the old MCP address are labelled and still work, and the SDK has a migration guide. No deprecation policy or dates (5). The security page names AWS us-east-2 and eu-central-1. The trust portal has a subprocessor section, of which our reader saw only OpenAI and Anthropic (12)." }, "sources": [ { "what": "docs index for agents", "url": "https://docs.anchorbrowser.io/llms.txt", "seen": "2026-10-08" }, { "what": "full docs corpus", "url": "https://docs.anchorbrowser.io/llms-full.txt", "seen": "2026-10-08" }, { "what": "OpenAPI document", "url": "https://docs.anchorbrowser.io/openapi.yaml", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://docs.anchorbrowser.io/pricing", "seen": "2026-10-08" }, { "what": "Agent Access", "url": "https://docs.anchorbrowser.io/quickstart/agent-access", "seen": "2026-10-08" }, { "what": "Agent Access guide endpoint, 200", "url": "https://api.anchorbrowser.io/v1/agent-access", "seen": "2026-10-08" }, { "what": "hosted MCP servers", "url": "https://docs.anchorbrowser.io/advanced/mcp", "seen": "2026-10-08" }, { "what": "MCP protected resource metadata", "url": "https://api.anchorbrowser.io/.well-known/oauth-protected-resource", "seen": "2026-10-08" }, { "what": "self-hosted MCP server docs", "url": "https://docs.anchorbrowser.io/advanced/mcp-open-source", "seen": "2026-10-08" }, { "what": "self-hosted MCP server source", "url": "https://github.com/browsermcp-com/mcp", "seen": "2026-10-08" }, { "what": "security page", "url": "https://docs.anchorbrowser.io/security", "seen": "2026-10-08" }, { "what": "Zero Data Retention mode", "url": "https://docs.anchorbrowser.io/security/zdr-mode", "seen": "2026-10-08" }, { "what": "session timeouts", "url": "https://docs.anchorbrowser.io/advanced/session-timeout", "seen": "2026-10-08" }, { "what": "SDK overview", "url": "https://docs.anchorbrowser.io/sdk-reference/overview", "seen": "2026-10-08" }, { "what": "unauthenticated session request, 401", "url": "https://api.anchorbrowser.io/v1/sessions", "seen": "2026-10-08" }, { "what": "x402 blog post", "url": "https://anchorbrowser.io/blog/pay-to-win-coinbase-x402-anchor-partnership", "seen": "2026-10-08" }, { "what": "status page", "url": "https://status.anchorbrowser.io/", "seen": "2026-10-08" }, { "what": "status incidents JSON", "url": "https://status.anchorbrowser.io/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "trust portal", "url": "https://trust.anchorbrowser.io/", "seen": "2026-10-08" }, { "what": "website terms of use", "url": "https://anchorbrowser.io/terms", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://anchorbrowser.io/privacy-policy", "seen": "2026-10-08" }, { "what": "security.txt, 404", "url": "https://anchorbrowser.io/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "TypeScript SDK on npm", "url": "https://registry.npmjs.org/anchorbrowser", "seen": "2026-10-08" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/anchorbrowser", "seen": "2026-10-08" }, { "what": "Python SDK on PyPI", "url": "https://pypi.org/pypi/anchorbrowser/json", "seen": "2026-10-08" }, { "what": "PyPI recent downloads", "url": "https://pypistats.org/api/packages/anchorbrowser/recent", "seen": "2026-10-08" }, { "what": "TypeScript SDK source", "url": "https://github.com/anchorbrowser/AnchorBrowser-SDK-Typescript", "seen": "2026-10-08" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=anchorbrowser", "seen": "2026-10-08" }, { "what": "docs changelog, 404", "url": "https://docs.anchorbrowser.io/changelog", "seen": "2026-10-08" }, { "what": "blog index", "url": "https://anchorbrowser.io/blog", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.identitydigital.services/rdap/domain/anchorbrowser.io", "seen": "2026-10-08" } ], "openQuestions": [ "No service agreement, API terms, SLA or public DPA was found on anchorbrowser.io or in the docs, so `provenance.terms` is left out. The pages /terms-of-service, /msa, /dpa, /sla and /legal return 404", "Whether x402 payment works on `POST /v1/sessions`. The blog post of 29 August 2025 says so, our unpaid request returned 401, and the post says x402 must be enabled per project", "unchecked: the Agent Access flow end to end. We read the guide endpoint and did not request a challenge or a key", "unchecked: the hosted MCP servers' tool list, schemas and annotations, which need a key or sign-in. The count of about 24 tools comes from the docs table", "unchecked: the trust portal's documents and full subprocessor list, which load by script or need an access request", "unchecked: GitHub stars, issues and CI results, because the GitHub API refused us for its rate limit", "unchecked: the anchorbrowser/anchor-mcp-plugin repository named in the MCP docs, which asked for credentials when cloned", "unchecked: how API keys are created, rotated and revoked in the dashboard, and whether signup for the Free plan asks for a card", "The MCP registry search returned no entry for anchorbrowser. The response body was empty, so this is weaker than a confirmed absence", "The security page says Anchor does not store customer data from sessions, while recordings are on by default and the pricing page lists 7 days of data retention", "Blog index dates carry no year, so launch dates for Agent Access (8 September) and the Bedrock AgentCore payments integration (24 August) are not confirmed as 2026", "The lead named the vendor as Anchor Browser. The terms and privacy policy name Anchor Forge Inc." ] }, "negative": 0, "verdict": "The API has a public OpenAPI 3.1 document, per-unit prices and Agent Access, an unauthenticated flow that issues a trial API key without a dashboard account. No service agreement is published, only a website terms of use, and the documented CDP connection puts the API key in the URL.", "bestFor": "Agents that must work inside signed-in accounts, with managed identities, MFA handling and a human sign-in link, and agents that need to start with no human signup.", "strengths": [ "Agent Access issues an API key through two unauthenticated calls and a puzzle, with 1 trial credit, or 5 with a verified-email OIDC token", "OpenAPI 3.1 document with 101 paths and 136 operations, llms.txt, llms-full.txt and a Markdown twin of every docs page", "Per-unit prices published without login, $0.01 a browser, $0.05 a browser-hour and $8 a GB of proxy traffic", "Hosted MCP servers at api.anchorbrowser.io/v1/mcp accept OAuth sign-in or the API key header, with read and write endpoint calls as separate tools", "Managed identities sign in and handle MFA without returning credentials to the agent, and secrets can be limited to matching domains, per the docs" ], "weaknesses": [ "No service agreement or API terms found. anchorbrowser.io/terms is a website terms of use dated 16 March 2025", "The documented CDP connection passes the API key as `apiKey` in the `wss://connect.anchorbrowser.io` URL", "No changelog, deprecation policy or published SLA found, and docs.anchorbrowser.io/changelog returns 404", "The status page lists two components, Website and Anchor Application, and its incident feed has never held an entry", "A 2025 blog post describes x402 payment on `POST /v1/sessions`, but an unpaid request on 8 October 2026 returned 401, not 402" ], "agentNotes": [ "Send the key in the `anchor-api-key` header. For CDP, build `wss://connect.anchorbrowser.io?apiKey=\u003ckey\u003e\u0026sessionId=\u003cid\u003e` and keep that URL out of logs", "Set `session.timeout.idle_timeout` and `max_duration` and end sessions with DELETE. The default maximum is 180 minutes, and browser time bills by the minute", "Session creation is capped at 5 a minute on Free, 25 on Starter and 100 on Growth. On 429, wait for the `Retry-After` seconds", "Connect the `Anchor` MCP server or `Anchor (all)`, not both, because the docs say the pair duplicates tool names", "Authenticated browsers, CAPTCHA solving and proxies by country need the Starter plan or higher. The Free plan and Agent Access keys run plain sessions and web tasks" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.3 } ], "editorialScores": { "ergonomics": 73, "maintenance": 57, "payments": 60, "reliability": 80, "schema": 80, "security": 54, "transparency": 40 }, "provenanceScore": 61 }, "connect": { "install": "npm install anchorbrowser", "http": "curl -X POST https://api.anchorbrowser.io/v1/tools/perform-web-task -H \"anchor-api-key: YOUR_API_KEY\" -H \"Content-Type: application/json\" -d '{\"prompt\":\"Go to example.com and return the page title\",\"url\":\"https://example.com\"}'", "claudeCode": "claude mcp add --transport http anchor https://api.anchorbrowser.io/v1/mcp", "config": { "mcpServers": { "anchor": { "headers": { "anchor-api-key": "YOUR_ANCHOR_API_KEY" }, "url": "https://api.anchorbrowser.io/v1/mcp" } } } }, "letme": { "capability": "https://letme.dev/browser.control", "tool": "https://letme.dev/anchor-browser" }, "notable": [ "Agent Access. `GET /v1/agent-access/challenge` returns a puzzle and a token valid 120 seconds, and `POST /v1/agent-access` returns an `api_key` with 1 credit, or 5 with a verified-email OIDC token. Sessions on these keys end after 60 minutes (https://docs.anchorbrowser.io/quickstart/agent-access)", "Four hosted MCP servers under https://api.anchorbrowser.io/v1/mcp, the main set of about 24 tools, `/all` with every REST route as a tool, `/actions/{domain}` with per-site recipes and `/browser` for step-by-step control (https://docs.anchorbrowser.io/advanced/mcp)", "Infrastructure prices are $0.01 a browser created, $0.05 a browser-hour, $8 a GB through Anchor's proxy and $0.20 a GB otherwise. AI steps cost $0.01 to $0.10 by model tier from 21 August 2026 (https://docs.anchorbrowser.io/pricing)", "Each browser runs in its own virtual machine that is destroyed when the session ends, hosted in AWS us-east-2, with eu-central-1 on the Growth plan, per the security page (https://docs.anchorbrowser.io/security)", "A blog post dated 29 August 2025 says `POST /v1/sessions` accepts x402 payment. Our unpaid request on 8 October 2026 returned 401, and the docs describe x402 only as an option that lets a session pay other sites (https://anchorbrowser.io/blog/pay-to-win-coinbase-x402-anchor-partnership)", "The self-hosted MCP server at browsermcp-com/mcp is Apache-2.0, a fork of Microsoft's Playwright MCP, with its last commit on 24 July 2025 (https://github.com/browsermcp-com/mcp)", "The trust portal lists SOC 2 Type 1 and Type 2, ISO 27001, HIPAA, GDPR and CCPA, with reports behind an access request (https://trust.anchorbrowser.io/)" ], "area": "developer", "details": [ { "label": "Surface graded", "value": "The hosted API at https://api.anchorbrowser.io with CDP at wss://connect.anchorbrowser.io and the hosted MCP servers. The self-hosted MCP server is described but not graded" }, { "label": "API", "value": "OpenAPI 3.1.0, version 1.0.0, 101 paths and 136 operations under /v1. Sessions, AI tools, tasks, applications and identities, profiles, OS-level control, recordings, batch sessions, webhooks, volumes, extensions, certificates and billing" }, { "label": "MCP servers", "value": "Hosted, streamable HTTP. /v1/mcp (web tasks, site actions, saved tasks, managed logins, sessions, docs search and endpoint discovery), /v1/mcp/all, /v1/mcp/actions/{domain} and /v1/mcp/browser. OAuth sign-in through signin.anchorbrowser.io or the `anchor-api-key` header" }, { "label": "Agent Access", "value": "Unauthenticated. GET /v1/agent-access/challenge, then POST /v1/agent-access with the token and answer. 1 credit anonymous, 5 with a verified-email OIDC token from Google, GitHub or Vercel. 60-minute session cap" }, { "label": "Free plan", "value": "$5 of credits a month, up to 5 concurrent browsers, 5 session creations a minute, 7-day data retention, US region. No authenticated browsers, CAPTCHA solving or geolocation" }, { "label": "Rate limits", "value": "Session creation 5 a minute on Free, 25 on Starter, 100 on Growth. Concurrent browsers 5, 25 and 200. Web Unlocker 2,000 requests a minute per API key" }, { "label": "Session limits", "value": "Default maximum duration 180 minutes, set with `session.timeout.max_duration`, and `idle_timeout` ends a session after its last connection drops" }, { "label": "Errors", "value": "JSON body `{error: {code, message}}` with the HTTP status as the code. 429 on session creation carries `RateLimit` and `Retry-After` headers. 402 means insufficient credits. Agent Access errors carry a `next` step" }, { "label": "SDKs", "value": "TypeScript `anchorbrowser` 1.0.0 on npm (26 July 2026) and Python `anchorbrowser` 1.0.1 on PyPI (28 July 2026), both Apache-2.0 and generated from the OpenAPI document" }, { "label": "Managed logins", "value": "Applications and identities sign in to third-party sites and handle TOTP and email codes. Identity links let a person sign in without giving the agent a password. A 1Password integration is documented" }, { "label": "Observability", "value": "Session recordings on by default with pause, resume and delete, a live view with a read-only mode, session history with filters, webhook delivery logs and a billing usage endpoint" }, { "label": "Security", "value": "SOC 2 Type 2, ISO 27001, HIPAA and GDPR per the security page and the SafeBase trust portal. Zero Data Retention mode on request. No security.txt. The SDK's SECURITY.md sends reports to support@anchorbrowser.io" }, { "label": "Regions", "value": "AWS us-east-2 by default. eu-central-1, Asia and Australia on Growth, any region on Enterprise" } ], "unitPrices": [ { "item": "Browser creation", "unit": "call", "usd": 0.01, "note": "Per browser instance created" }, { "item": "Browser usage", "unit": "browser-hour", "usd": 0.05, "note": "Counted to the nearest full minute" }, { "item": "Anchor proxy traffic", "unit": "gb", "usd": 8 }, { "item": "Egress with your own proxy or none", "unit": "gb", "usd": 0.2 }, { "item": "AI step, Light model tier", "unit": "call", "usd": 0.01, "note": "Also the flat rate with your own model key" }, { "item": "AI step, Standard model tier", "unit": "call", "usd": 0.05 }, { "item": "AI step, High Performance model tier", "unit": "call", "usd": 0.1 }, { "item": "Overage credit, Starter and Growth", "unit": "credit", "usd": 1 }, { "item": "Starter plan", "unit": "month", "usd": 50 }, { "item": "Growth plan", "unit": "month", "usd": 2000 } ], "provenance": { "legalEntity": "Anchor Forge Inc.", "domain": "anchorbrowser.io", "domainRegistered": "2024-09-18", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://anchorbrowser.io/privacy-policy", "statusPage": "https://status.anchorbrowser.io", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The website terms of use (last updated 16 March 2025) and the privacy policy (last updated 24 February 2026) name Anchor Forge Inc. and its affiliates. The terms choose New York law.", "No terms URL is recorded. anchorbrowser.io/terms is a website terms of use that grants personal, non-commercial use of the site, and no service agreement or API terms were found.", "The privacy policy is written for the website and customer contacts and has one product section, on Gmail access for sign-in codes. A DPA is listed in the trust portal behind an access request.", "The API and MCP servers answer at api.anchorbrowser.io, CDP at connect.anchorbrowser.io and OAuth sign-in at signin.anchorbrowser.io.", "anchorbrowser.io/.well-known/security.txt and docs.anchorbrowser.io/.well-known/security.txt both return 404. The trust portal at trust.anchorbrowser.io runs on SafeBase.", "RDAP for anchorbrowser.io gives a registration date of 2024-09-18.", "docs.anchorbrowser.io/changelog returns 404 and no API changelog was found." ], "score": 61, "checks": [ { "check": "Legal entity named", "value": "Anchor Forge Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "anchorbrowser.io, registered 2024-09-18 (2 years)", "points": 7, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "api.anchorbrowser.io", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.anchorbrowser.io", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://anchorbrowser.io/privacy-policy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-02-24", "words": 4543, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: February 24th, 2026", "says": "Last updated 2026-02-24" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This privacy policy (\"Privacy Policy\") governs how we, Anchor Forge Inc., and its affiliates (\"Anchor\" \"we\", \"our\" or \"us\") use, collect, disclose, and store Personal Data we collect or receive from or about you (\"you\") such as in the following use cases:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Your Personal Data will be stored until we no longer need the information and proactively delete it, or you send a valid deletion request." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "When we use the Personal Data of our service providers (e.g." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Please read this Privacy Policy carefully, so you can understand our practices and your rights in relation to personal data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions, concerns or complaints regarding our compliance with this notice and the data protection laws, or if you wish to exercise your rights, we encourage you to first contact us at support@anchorbrowser.io.", "says": "support@anchorbrowser.io" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "When Anchor engages in such transfers of personal information, it relies on i) Adequacy Decisions as adopted by European Commission on the basis of Article 45 of Regulation (EU) 2016/679 (GDPR) (for example, when we access from Israel), or ii) Standard Contractual Clauses issued by the European Commission.", "says": "Relies on standard contractual clauses" } ], "notes": [ { "date": "2026-10-08", "text": "With user consent, Anchor Browser reads Gmail with the gmail.readonly permission to retrieve one-time verification codes for login workflows.", "quote": "Anchor Browser requests the gmail.readonly permission to retrieve one-time verification codes sent to a user’s Gmail inbox as part of completing a login process." }, { "date": "2026-10-08", "text": "Anchor uses FullStory, which collects session recordings, clicks, scrolls, device type and IP address.", "quote": "FullStory collects data such as session recordings, clicks, scrolls, and technical information like device type and IP address." }, { "date": "2026-10-08", "text": "After an account is deleted, public activity from before the deletion stays stored on Anchor's servers and accessible to the public.", "quote": "However, given the nature of sharing on certain services, any public activity on your account prior to deletion will remain stored on our servers and will remain accessible to the public." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/anchor-browser.json", "live": { "slug": "anchor-browser", "probe": { "target": "https://api.anchorbrowser.io", "method": "get", "lastAt": "2026-10-08T19:08:39.180219468Z", "lastOk": true, "lastStatus": 404, "lastMs": 437, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 390, "p95ms24h": 474, "samples24h": 19, "samples30d": 19, "days": [ { "date": "2026-10-08", "probes": 19, "ok": 19 } ] }, "vendorStatus": { "page": "https://status.anchorbrowser.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:06:25.717325901Z" }, "pages": [ { "url": "https://docs.anchorbrowser.io/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:18:10.688067751Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d1115f8035fb" }, { "url": "https://anchorbrowser.io/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:15:09.984357233Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "5503a044040d" } ], "updatedAt": "2026-10-08T19:08:39.180219468Z" } } }