{
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-10-14",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.4",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run"
  },
  "tool": {
    "slug": "autohotkey",
    "name": "AutoHotkey",
    "vendor": "AutoHotkey Foundation",
    "vendorUrl": "https://www.autohotkey.com",
    "kind": "sdk",
    "category": "desktop-automation",
    "summary": "AutoHotkey is a free, open-source scripting language and interpreter for Windows that sends keystrokes and mouse input, manages windows and controls, and defines hotkeys. Agents run scripts through the `AutoHotkey64.exe` command line, including from standard input.",
    "url": "https://www.anchorterminal.com/tools/autohotkey",
    "markdownUrl": "https://www.anchorterminal.com/tools/autohotkey.md",
    "slimMarkdownUrl": "https://www.anchorterminal.com/tools/autohotkey.min.md",
    "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/autohotkey.json",
    "repo": "https://github.com/AutoHotkey/AutoHotkey",
    "license": "GPL-2.0",
    "transports": [],
    "packages": [],
    "auth": "none",
    "authNotes": "No account, key or credential. Scripts run with the rights of the Windows user who starts the interpreter, and reach every window, control, file and process that user can.",
    "pricing": "free",
    "pricingNotes": "Free and open source under GPL-2.0, with nothing to buy and no hosted service. The repository's FUNDING.yml takes donations (checked 2026-10-14).",
    "priceSummary": "Free · OSS",
    "where": "local",
    "x402": {
      "level": "no",
      "evidence": "No x402, MPP or L402 in the source, the documentation repository or the home page (checked 2026-10-14).",
      "endpoints": []
    },
    "toolCount": null,
    "popularity": {
      "githubStars": 13288,
      "npmWeekly": null,
      "pypiWeekly": null,
      "asOf": "2026-10-14"
    },
    "docsUrl": "https://www.autohotkey.com/docs/v2/",
    "capabilities": [
      "desktop.control",
      "desktop.scripting"
    ],
    "tags": [
      "open-source",
      "local",
      "windows",
      "cli",
      "scripting",
      "free",
      "no-auth"
    ],
    "lastRelease": "2026-10-09",
    "graded": true,
    "anchor": {
      "graded": true,
      "score": 52.8,
      "grade": "D",
      "agentReady": false,
      "rank": 771,
      "ranked": true,
      "rankOf": 1076,
      "categoryRank": 4,
      "methodology": "0.4",
      "run": "2026-10-01",
      "scores": {
        "ergonomics": 46,
        "maintenance": 72,
        "payments": 60,
        "reliability": 61,
        "schema": 54,
        "security": 24,
        "transparency": 73
      },
      "pending": [
        "performance",
        "tasks"
      ],
      "breakdown": [
        {
          "key": "reliability",
          "name": "Reliability",
          "weight": 16,
          "effectiveWeight": 20,
          "score": 61,
          "points": 12.2,
          "reason": "Read with the local-software lines, since the owner runs the interpreter. Official builds are a zip and a setup executable on GitHub releases for 32-bit and 64-bit Windows. The supported Windows versions were on autohotkey.com, which a bot check blocked, so not confirmed (18 of 20). The repository has no CI workflow and no test suite (0 of 25). GitHub Issues was disabled from 2017 until October 2026 and now shows one open issue and ten open pull requests, the oldest from 2022. Bug reports go to the forum, which we could not read (15 of 25). A dated changelog for every release. 2.0.x releases carry fixes only and additions go to 2.1 alphas, though the changelog records regressions such as one `broken by v2.0.20` and fixed in 2.0.30 (13 of 15). Version 2.0 is the stable line (15)."
        },
        {
          "key": "performance",
          "name": "Performance",
          "weight": 10,
          "effectiveWeight": 0,
          "pending": true,
          "points": 0,
          "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes."
        },
        {
          "key": "schema",
          "name": "Schema \u0026 documentation",
          "weight": 13,
          "effectiveWeight": 16.25,
          "score": 54,
          "points": 8.78,
          "reason": "Graded as a scripting language driven from the command line. No machine-readable contract for the language or the command line (0 of 25). No llms.txt found, and the documentation is HTML in the AutoHotkeyDocs repository (0 of 10). 356 function reference pages state what each function does, its parameters and when it raises an error (17 of 20). Parameters are documented with types, defaults and allowed values, in a dynamically typed language (9 of 15). Every function page has examples, and errors raised are named per function, with the `Error` class hierarchy documented (13 of 15). Versioned releases and a dated changelog back to 2003 (15)."
        },
        {
          "key": "ergonomics",
          "name": "Agent ergonomics",
          "weight": 13,
          "effectiveWeight": 16.25,
          "score": 46,
          "points": 7.48,
          "reason": "The command line adds no tool definitions to context, but output is whatever the script writes, with no structured format (15 of 25). Output size and filtering are up to the script. Window functions take title, class, process and exclusion criteria (8 of 20). `/ErrorStdOut` puts load-time errors on stderr and `/Validate` exits non-zero on a load error, while runtime errors open a dialog unless the script uses `OnError` or `try` (12 of 20). Keystrokes and clicks cannot be safely retried and there is no dry run beyond `/Validate` (4 of 20). One executable, scripts on standard input with `*`, and an experimental DLL host. No SDK in a second language (7 of 15)."
        },
        {
          "key": "security",
          "name": "Security \u0026 auth",
          "weight": 14,
          "effectiveWeight": 17.5,
          "score": 24,
          "points": 4.2,
          "reason": "No credential model. Scripts run with every right of the user who starts them, the closest case to one all-powerful key (10 of 30). No read-only mode, permission scoping or confirmation step for actions (3 of 20). Scripts read window text, controls and the clipboard, which can carry untrusted content, and no guidance on prompt injection was found (3 of 15). `ListLines`, `KeyHistory` and the debugger show what a script did, with no audit log (4 of 15). No SECURITY.md, no published advisories and no security.txt could be read. A code signing policy is linked from the home page and could not be read past the bot check (4 of 20)."
        },
        {
          "key": "payments",
          "name": "Payments \u0026 pricing",
          "weight": 10,
          "effectiveWeight": 12.5,
          "score": 60,
          "points": 7.5,
          "reason": "Read with the self-hosted rule. Free software with nothing to buy, so 20 + 20 + 20. No x402, MPP or L402 (0 of 40)."
        },
        {
          "key": "tasks",
          "name": "Task success",
          "weight": 10,
          "effectiveWeight": 0,
          "pending": true,
          "points": 0,
          "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored."
        },
        {
          "key": "maintenance",
          "name": "Maintenance \u0026 community",
          "weight": 7,
          "effectiveWeight": 8.75,
          "score": 72,
          "points": 6.3,
          "reason": "2.0.30 on 9 October 2026 (30). 2.0.27 to 2.0.30 between 28 August and 9 October 2026, plus 2.1 alphas 31 to 35 (20). The changelog credits merged pull requests from outside contributors, but pull requests from 2022 to 2025 remain open with no decision, and the forum where bugs are reported could not be read (12 of 25). No MCP server or package registry entry. Release assets are current on GitHub (7 of 15). No CI and no dependency tooling in the repository (3 of 10)."
        },
        {
          "key": "transparency",
          "name": "Transparency \u0026 trust",
          "weight": 7,
          "effectiveWeight": 8.75,
          "score": 73,
          "points": 6.39,
          "note": "editorial 73, provenance 73",
          "reason": "The editorial half. GPL-2.0 on the repository and on the home page (30). No privacy statement for the software. A search of the interpreter source found no network code, and the docs describe the one optional update check (15 of 30). The README says v1 is not maintained, and deprecated switches such as `/iLib` are marked in the docs, with no dated deprecation policy (10 of 20). The update check is off by default and documented with its registry switch, and no telemetry was found (18 of 20). The provenance half is computed from the provenance block."
        }
      ],
      "assessment": {
        "date": "2026-10-14",
        "basis": "public evidence",
        "confidence": "medium",
        "notes": {
          "ergonomics": "The command line adds no tool definitions to context, but output is whatever the script writes, with no structured format (15 of 25). Output size and filtering are up to the script. Window functions take title, class, process and exclusion criteria (8 of 20). `/ErrorStdOut` puts load-time errors on stderr and `/Validate` exits non-zero on a load error, while runtime errors open a dialog unless the script uses `OnError` or `try` (12 of 20). Keystrokes and clicks cannot be safely retried and there is no dry run beyond `/Validate` (4 of 20). One executable, scripts on standard input with `*`, and an experimental DLL host. No SDK in a second language (7 of 15).",
          "maintenance": "2.0.30 on 9 October 2026 (30). 2.0.27 to 2.0.30 between 28 August and 9 October 2026, plus 2.1 alphas 31 to 35 (20). The changelog credits merged pull requests from outside contributors, but pull requests from 2022 to 2025 remain open with no decision, and the forum where bugs are reported could not be read (12 of 25). No MCP server or package registry entry. Release assets are current on GitHub (7 of 15). No CI and no dependency tooling in the repository (3 of 10).",
          "payments": "Read with the self-hosted rule. Free software with nothing to buy, so 20 + 20 + 20. No x402, MPP or L402 (0 of 40).",
          "reliability": "Read with the local-software lines, since the owner runs the interpreter. Official builds are a zip and a setup executable on GitHub releases for 32-bit and 64-bit Windows. The supported Windows versions were on autohotkey.com, which a bot check blocked, so not confirmed (18 of 20). The repository has no CI workflow and no test suite (0 of 25). GitHub Issues was disabled from 2017 until October 2026 and now shows one open issue and ten open pull requests, the oldest from 2022. Bug reports go to the forum, which we could not read (15 of 25). A dated changelog for every release. 2.0.x releases carry fixes only and additions go to 2.1 alphas, though the changelog records regressions such as one `broken by v2.0.20` and fixed in 2.0.30 (13 of 15). Version 2.0 is the stable line (15).",
          "schema": "Graded as a scripting language driven from the command line. No machine-readable contract for the language or the command line (0 of 25). No llms.txt found, and the documentation is HTML in the AutoHotkeyDocs repository (0 of 10). 356 function reference pages state what each function does, its parameters and when it raises an error (17 of 20). Parameters are documented with types, defaults and allowed values, in a dynamically typed language (9 of 15). Every function page has examples, and errors raised are named per function, with the `Error` class hierarchy documented (13 of 15). Versioned releases and a dated changelog back to 2003 (15).",
          "security": "No credential model. Scripts run with every right of the user who starts them, the closest case to one all-powerful key (10 of 30). No read-only mode, permission scoping or confirmation step for actions (3 of 20). Scripts read window text, controls and the clipboard, which can carry untrusted content, and no guidance on prompt injection was found (3 of 15). `ListLines`, `KeyHistory` and the debugger show what a script did, with no audit log (4 of 15). No SECURITY.md, no published advisories and no security.txt could be read. A code signing policy is linked from the home page and could not be read past the bot check (4 of 20).",
          "transparency": "The editorial half. GPL-2.0 on the repository and on the home page (30). No privacy statement for the software. A search of the interpreter source found no network code, and the docs describe the one optional update check (15 of 30). The README says v1 is not maintained, and deprecated switches such as `/iLib` are marked in the docs, with no dated deprecation policy (10 of 20). The update check is off by default and documented with its registry switch, and no telemetry was found (18 of 20). The provenance half is computed from the provenance block."
        },
        "sources": [
          {
            "what": "repository, README and source at the alpha branch (11 October 2026)",
            "url": "https://github.com/AutoHotkey/AutoHotkey",
            "seen": "2026-10-14"
          },
          {
            "what": "releases 2.0.27 to 2.0.30 and their assets",
            "url": "https://api.github.com/repos/AutoHotkey/AutoHotkey/releases",
            "seen": "2026-10-14"
          },
          {
            "what": "repository record (stars, issues enabled, licence)",
            "url": "https://api.github.com/repos/AutoHotkey/AutoHotkey",
            "seen": "2026-10-14"
          },
          {
            "what": "open pull requests",
            "url": "https://api.github.com/repos/AutoHotkey/AutoHotkey/pulls?state=open",
            "seen": "2026-10-14"
          },
          {
            "what": "security advisories (none)",
            "url": "https://api.github.com/repos/AutoHotkey/AutoHotkey/security-advisories",
            "seen": "2026-10-14"
          },
          {
            "what": "v2 documentation source, command line switches and stdin",
            "url": "https://github.com/AutoHotkey/AutoHotkeyDocs/blob/v2/docs/Scripts.htm",
            "seen": "2026-10-14"
          },
          {
            "what": "v2 changelog",
            "url": "https://github.com/AutoHotkey/AutoHotkeyDocs/blob/v2/docs/ChangeLog.htm",
            "seen": "2026-10-14"
          },
          {
            "what": "Dash update check",
            "url": "https://github.com/AutoHotkey/AutoHotkeyDocs/blob/v2/docs/Program.htm",
            "seen": "2026-10-14"
          },
          {
            "what": "FileAppend to stdout",
            "url": "https://github.com/AutoHotkey/AutoHotkeyDocs/blob/v2/docs/lib/FileAppend.htm",
            "seen": "2026-10-14"
          },
          {
            "what": "home page (licence and code signing policy links)",
            "url": "https://www.autohotkey.com/",
            "seen": "2026-10-14"
          },
          {
            "what": "RDAP record for autohotkey.com",
            "url": "https://rdap.verisign.com/com/v1/domain/autohotkey.com",
            "seen": "2026-10-14"
          }
        ],
        "openQuestions": [
          "unchecked: www.autohotkey.com robots.txt, security.txt, code signing policy and download pages, which returned a Cloudflare challenge or 403 after one read of the home page on 14 October 2026",
          "unchecked: bug reports and their response times on the community forum, which sits on the same blocked domain",
          "unchecked: the supported Windows versions as stated on the download page",
          "Community MCP servers named ahk-mcp exist. None is from the AutoHotkey project, and none was graded"
        ]
      },
      "negative": 0,
      "verdict": "An agent can write a script and run it through the command line, with a script read from standard input, `/Validate` and `/ErrorStdOut` for clean failures, and a function reference of 356 pages. It runs on Windows only with the user's full rights, and the repository has no CI or test suite.",
      "bestFor": "An agent automating Windows desktop apps on one machine by writing short scripts.",
      "strengths": [
        "Scripts can be piped to the interpreter on standard input with `*` as the filename",
        "`/Validate` checks a script without running it and exits non-zero on a load error",
        "Four 2.0.x bug-fix releases between 28 August and 9 October 2026, each in a dated changelog",
        "GPL-2.0 source, and no network code found in the interpreter",
        "Function reference of 356 pages with parameters, return values, errors raised and examples"
      ],
      "weaknesses": [
        "Windows only, and scripts act with every right of the user who runs them",
        "No CI workflow or test suite in the repository",
        "No security policy, security.txt or published advisory was found",
        "Bug reports go to a forum, and GitHub Issues was only switched on in October 2026",
        "Runtime errors open a dialog unless the script handles them with `OnError` or `try`"
      ],
      "agentNotes": [
        "Write output with `FileAppend text, \"*\"` and pipe the interpreter's output, since stdout does not appear at the console it was launched from",
        "Run `AutoHotkey64.exe /ErrorStdOut /Validate script.ahk` before running a new script",
        "Add `OnError` or `try` blocks so a runtime error does not leave a dialog open in an unattended run",
        "Target v2 syntax. v1 is unmaintained and its scripts do not run on v2"
      ],
      "metrics": {
        "kind": "local",
        "measured": false
      },
      "reviewCount": 0,
      "avgRating": 0,
      "history": [
        {
          "basis": "public evidence",
          "confidence": "medium",
          "grade": "D",
          "methodology": "0.4",
          "pending": [
            "performance",
            "tasks"
          ],
          "run": "2026-10-01",
          "runLabel": "October 2026 research run",
          "score": 52.8
        }
      ],
      "editorialScores": {
        "ergonomics": 46,
        "maintenance": 72,
        "payments": 60,
        "reliability": 61,
        "schema": 54,
        "security": 24,
        "transparency": 73
      },
      "provenanceScore": 73
    },
    "connect": {
      "headless": {
        "run": "AutoHotkey64.exe /ErrorStdOut script.ahk arg1 arg2",
        "stdin": "type script.ahk | AutoHotkey64.exe /ErrorStdOut *",
        "validate": "AutoHotkey64.exe /ErrorStdOut /Validate script.ahk"
      }
    },
    "letme": {
      "capability": "https://letme.dev/desktop.control",
      "tool": "https://letme.dev/autohotkey"
    },
    "notable": [
      "`AutoHotkey.exe [Switches] [Script Filename] [Script Parameters]`, where `*` as the filename reads the script from standard input, `/ErrorStdOut` sends load-time errors to stderr and `/Validate` loads a script and exits non-zero on error (https://github.com/AutoHotkey/AutoHotkeyDocs/blob/v2/docs/Scripts.htm)",
      "Version 2.0.30 was released on 9 October 2026 and 2.1-alpha.35 was tagged on 11 October 2026 (https://github.com/AutoHotkey/AutoHotkey/releases)",
      "GitHub Issues was disabled from 2017 until October 2026, and bug reports go to the community forum (https://github.com/AutoHotkey/AutoHotkey/blob/alpha/README.md)",
      "The repository has no CI workflow and no test suite. Release assets are a zip and a setup executable (https://github.com/AutoHotkey/AutoHotkey)",
      "AutoHotkey v1 is not maintained, per the README (https://github.com/AutoHotkey/AutoHotkey/blob/alpha/README.md)",
      "Dash, the launcher, has an update check from 2.0.24 that is off by default and turned on through a registry value (https://github.com/AutoHotkey/AutoHotkeyDocs/blob/v2/docs/Program.htm)",
      "No official MCP server was found. Community servers named ahk-mcp exist and are not graded here"
    ],
    "area": "developer",
    "details": [
      {
        "label": "Surface",
        "value": "An interpreter executable with command-line switches (`/force`, `/restart`, `/ErrorStdOut`, `/Debug`, `/CPn`, `/Validate`, `/include`). Scripts reach stdout with `FileAppend` to `*`. An experimental DLL build hosts the interpreter. No MCP server, HTTP API or official package registry entry"
      },
      {
        "label": "What scripts control",
        "value": "Keystrokes and mouse input, windows and controls by title, class or process, the clipboard, GUI creation, COM objects, DLL calls and processes"
      },
      {
        "label": "Platforms",
        "value": "Windows only. 32-bit and 64-bit builds, with experimental ARM64 support proposed in an open pull request (#360)"
      },
      {
        "label": "Versions",
        "value": "2.0.30 (stable, 9 October 2026) and 2.1-alpha.35 (11 October 2026). v1 is unmaintained"
      },
      {
        "label": "Releases",
        "value": "2.0.27 on 28 August, 2.0.28 on 12 September, 2.0.29 on 3 October and 2.0.30 on 9 October 2026, as a zip and a setup executable on GitHub"
      },
      {
        "label": "Telemetry",
        "value": "No network code found in the interpreter source. Dash's update check is off by default"
      },
      {
        "label": "Support",
        "value": "Community forum for help and bug reports. GitHub Issues was opened in October 2026 after being disabled since 2017"
      }
    ],
    "provenance": {
      "legalEntity": "AutoHotkey Foundation LLC",
      "domain": "autohotkey.com",
      "domainRegistered": "2003-12-29",
      "domainNote": "The interpreter's version resource names AutoHotkey Foundation LLC as the company. RDAP for autohotkey.com gives a registration date of 2003-12-29.",
      "endpointOnVendorDomain": null,
      "terms": "",
      "privacy": "",
      "statusPage": "",
      "changelog": "https://www.autohotkey.com/docs/v2/ChangeLog.htm",
      "securityTxt": "unknown",
      "checked": "2026-10-14",
      "notes": [
        "No terms of service or privacy policy for the software was found. The home page links the GNU GPLv2 and a code signing policy, and no privacy or terms link, so `terms` and `privacy` are left out.",
        "www.autohotkey.com answered curl with a Cloudflare challenge on 14 October 2026. One read of the home page succeeded, and later reads of robots.txt, security.txt and the code signing policy returned 403, so security.txt is recorded as unknown.",
        "The changelog URL is the published copy of docs/ChangeLog.htm in the AutoHotkeyDocs repository, which was read from the repository."
      ],
      "score": 73,
      "checks": [
        {
          "check": "Legal entity named",
          "value": "AutoHotkey Foundation LLC",
          "points": 20,
          "max": 20,
          "state": "ok"
        },
        {
          "check": "Domain age",
          "value": "autohotkey.com, registered 2003-12-29 (22 years)",
          "points": 15,
          "max": 15,
          "state": "ok"
        },
        {
          "check": "Endpoint on the vendor's domain",
          "value": "no hosted endpoint",
          "points": 0,
          "max": 0,
          "state": "na"
        },
        {
          "check": "Terms of service",
          "value": "nothing hosted, so the GPL-2.0 licence stands in",
          "points": 10,
          "max": 10,
          "state": "ok"
        },
        {
          "check": "Privacy policy",
          "value": "nothing hosted, not scored",
          "points": 0,
          "max": 0,
          "state": "na"
        },
        {
          "check": "Status page",
          "value": "not found",
          "points": 0,
          "max": 10,
          "state": "no"
        },
        {
          "check": "Changelog",
          "value": "published",
          "points": 10,
          "max": 10,
          "state": "ok"
        },
        {
          "check": "security.txt",
          "value": "could not be fetched",
          "points": 0,
          "max": 10,
          "state": "no"
        }
      ]
    },
    "pageJsonUrl": "https://www.anchorterminal.com/tools/autohotkey.json"
  }
}