{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "puppeteer", "name": "Puppeteer", "vendor": "Google", "vendorUrl": "https://pptr.dev", "kind": "sdk", "category": "browser", "summary": "Puppeteer is Google's open-source Node.js library for controlling Chrome and Firefox over the DevTools Protocol and WebDriver BiDi. An agent writes and runs scripts that navigate, click, type, read pages and take screenshots.", "url": "https://www.anchorterminal.com/tools/puppeteer", "markdownUrl": "https://www.anchorterminal.com/tools/puppeteer.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/puppeteer.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/puppeteer.json", "repo": "https://github.com/puppeteer/puppeteer", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "puppeteer" }, { "registry": "npm", "name": "puppeteer-core" } ], "auth": "none", "authNotes": "No account or key. The library runs on the owner's machine and launches or connects to a local browser. Site logins live in the browser profile or cookies the script sets. `puppeteer.connect()` to a remote browser uses whatever that endpoint requires.", "pricing": "free", "pricingNotes": "Free and open source under Apache-2.0, with nothing to buy and no hosted service from Google. `npm i puppeteer` downloads Chrome for Testing and chrome-headless-shell at install time (checked 2026-10-14).", "priceSummary": "Free ยท OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the docs or the source (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 95689, "npmWeekly": 11547242, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://pptr.dev", "capabilities": [ "browser.control", "browser.debug" ], "tags": [ "official", "local", "open-source", "browser", "sdk", "typescript", "no-auth" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 70.6, "grade": "BB", "agentReady": true, "rank": 154, "ranked": true, "rankOf": 1076, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 89, "payments": 60, "reliability": 80, "schema": 81, "security": 52, "transparency": 70 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 80, "points": 16, "reason": "Scored as local software. Official npm packages `puppeteer` and `puppeteer-core` at 25.13.0, with Node.js 22.12 or later stated in `engines` and a browser support table (20). Public CI runs Chrome and Firefox tests on Linux, macOS and Windows. Of the 20 most recent CI runs on main, 7 to 13 October 2026, 10 concluded in failure, the newest in Windows headful Firefox and Chrome pipe jobs (12 of 25). 272 open issues and pull requests. Confirmed bugs carry P2 or P3 labels, several without a reply, such as `page.goto()` ignoring its timeout after a second navigation (18 of 25). release-please with conventional commits, breaking changes under their own heading and a major version for each set (15). Version 25, stable (15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 81, "points": 13.16, "reason": "Graded as a library. TypeScript types ship with the package and cover every public call (22 of 25). No llms.txt and no Markdown routes on pptr.dev, though the docs and the 643-page API reference are Markdown in the repository (5 of 10). TSDoc on each member with remarks and parameter descriptions. Guides explain when to use locators or `page.$()`, with few statements of when not to use a call (14 of 20). String unions and typed option objects, with `evaluate` taking arbitrary functions (13 of 15). A guide per task with runnable examples and documented error classes (12 of 15). Versioned releases and a changelog for each (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 67, "points": 10.89, "reason": "A library adds no tool definitions to context. `page.accessibility.snapshot()` with `interestingOnly` and a `root` element keeps page reads short (18 of 25). Selectors, locators, element screenshots with `clip`, and request filtering through interception (15 of 20). Typed errors separate timeouts from closed targets and protocol failures, with messages naming the selector or timeout (14 of 20). Locators wait for visibility and stability and retry actions. No annotations or idempotency concept apply (10 of 20). `launch()` works with defaults and a bundled browser. JavaScript and TypeScript only (10 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 52, "points": 9.1, "reason": "No credential to leak and nothing to scope, so the middle band (20 of 30). Chrome's sandbox stays on unless the script turns it off, and request interception can block hosts. There is no allowlist on by default and no confirmation step (8 of 20). Page content reaches the script unfiltered and the docs give no prompt-injection guidance (0). Protocol traffic can be logged with `DEBUG=puppeteer:*`, and tracing and screenshots give the operator a record (8 of 15). SECURITY.md routes reports through Chromium's process, which has a reward programme, an OpenSSF Scorecards workflow runs daily, and no repository advisories were found (16 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Free, self-hosted, nothing to buy, so 20 + 20 + 20 under the self-hosted rule. No payment protocol (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 89, "points": 7.79, "reason": "25.13.0 on 8 October 2026 (30). Ten releases since 27 July 2026 (20). Confirmed bugs are labelled and pull requests merge most weeks, but many recent pull requests had no comment and a stale workflow closes unconfirmed bug reports after 21 days (18 of 25). Current official npm packages, no MCP server to register (15). Six runtime dependencies, pinned actions and Scorecards, with CI failing on half of recent runs (6 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 70, "points": 6.13, "note": "editorial 72, provenance 68", "reason": "Apache-2.0, published by Google (30). No data statement for the library. It runs locally, downloads browsers from Google's storage at install, and the docs say where browsers are cached (18 of 30). Each release lists breaking changes, deprecated APIs are marked in the reference, and the support table maps versions to browsers. No written deprecation policy (10 of 20). No telemetry found in the library source, and the docs do not say so either way (14 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "A library adds no tool definitions to context. `page.accessibility.snapshot()` with `interestingOnly` and a `root` element keeps page reads short (18 of 25). Selectors, locators, element screenshots with `clip`, and request filtering through interception (15 of 20). Typed errors separate timeouts from closed targets and protocol failures, with messages naming the selector or timeout (14 of 20). Locators wait for visibility and stability and retry actions. No annotations or idempotency concept apply (10 of 20). `launch()` works with defaults and a bundled browser. JavaScript and TypeScript only (10 of 15).", "maintenance": "25.13.0 on 8 October 2026 (30). Ten releases since 27 July 2026 (20). Confirmed bugs are labelled and pull requests merge most weeks, but many recent pull requests had no comment and a stale workflow closes unconfirmed bug reports after 21 days (18 of 25). Current official npm packages, no MCP server to register (15). Six runtime dependencies, pinned actions and Scorecards, with CI failing on half of recent runs (6 of 10).", "payments": "Free, self-hosted, nothing to buy, so 20 + 20 + 20 under the self-hosted rule. No payment protocol (0).", "reliability": "Scored as local software. Official npm packages `puppeteer` and `puppeteer-core` at 25.13.0, with Node.js 22.12 or later stated in `engines` and a browser support table (20). Public CI runs Chrome and Firefox tests on Linux, macOS and Windows. Of the 20 most recent CI runs on main, 7 to 13 October 2026, 10 concluded in failure, the newest in Windows headful Firefox and Chrome pipe jobs (12 of 25). 272 open issues and pull requests. Confirmed bugs carry P2 or P3 labels, several without a reply, such as `page.goto()` ignoring its timeout after a second navigation (18 of 25). release-please with conventional commits, breaking changes under their own heading and a major version for each set (15). Version 25, stable (15).", "schema": "Graded as a library. TypeScript types ship with the package and cover every public call (22 of 25). No llms.txt and no Markdown routes on pptr.dev, though the docs and the 643-page API reference are Markdown in the repository (5 of 10). TSDoc on each member with remarks and parameter descriptions. Guides explain when to use locators or `page.$()`, with few statements of when not to use a call (14 of 20). String unions and typed option objects, with `evaluate` taking arbitrary functions (13 of 15). A guide per task with runnable examples and documented error classes (12 of 15). Versioned releases and a changelog for each (15).", "security": "No credential to leak and nothing to scope, so the middle band (20 of 30). Chrome's sandbox stays on unless the script turns it off, and request interception can block hosts. There is no allowlist on by default and no confirmation step (8 of 20). Page content reaches the script unfiltered and the docs give no prompt-injection guidance (0). Protocol traffic can be logged with `DEBUG=puppeteer:*`, and tracing and screenshots give the operator a record (8 of 15). SECURITY.md routes reports through Chromium's process, which has a reward programme, an OpenSSF Scorecards workflow runs daily, and no repository advisories were found (16 of 20).", "transparency": "Apache-2.0, published by Google (30). No data statement for the library. It runs locally, downloads browsers from Google's storage at install, and the docs say where browsers are cached (18 of 30). Each release lists breaking changes, deprecated APIs are marked in the reference, and the support table maps versions to browsers. No written deprecation policy (10 of 20). No telemetry found in the library source, and the docs do not say so either way (14 of 20)." }, "sources": [ { "what": "repository, README, SECURITY.md and source at commit d8e4e36 (13 October 2026)", "url": "https://github.com/puppeteer/puppeteer", "seen": "2026-10-14" }, { "what": "puppeteer-core changelog", "url": "https://github.com/puppeteer/puppeteer/blob/main/packages/puppeteer-core/CHANGELOG.md", "seen": "2026-10-14" }, { "what": "releases", "url": "https://api.github.com/repos/puppeteer/puppeteer/releases?per_page=30", "seen": "2026-10-14" }, { "what": "CI runs on main", "url": "https://api.github.com/repos/puppeteer/puppeteer/actions/workflows/ci.yml/runs?branch=main\u0026per_page=20", "seen": "2026-10-14" }, { "what": "newest 30 open issues and pull requests", "url": "https://api.github.com/repos/puppeteer/puppeteer/issues?state=open\u0026per_page=30\u0026sort=created\u0026direction=desc", "seen": "2026-10-14" }, { "what": "stars, open issue count, licence", "url": "https://api.github.com/repos/puppeteer/puppeteer", "seen": "2026-10-14" }, { "what": "npm latest version and engines", "url": "https://registry.npmjs.org/puppeteer/latest", "seen": "2026-10-14" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/puppeteer", "seen": "2026-10-14" }, { "what": "supported browsers table", "url": "https://github.com/puppeteer/puppeteer/blob/main/docs/supported-browsers.md", "seen": "2026-10-14" }, { "what": "WebMCP guide", "url": "https://pptr.dev/guides/webmcp", "seen": "2026-10-14" }, { "what": "OSV advisories for puppeteer, puppeteer-core and @puppeteer/browsers (none)", "url": "https://api.osv.dev/v1/query", "seen": "2026-10-14" }, { "what": "pptr.dev registration date", "url": "https://pubapi.registry.google/rdap/domain/pptr.dev", "seen": "2026-10-14" } ], "openQuestions": [ "The reasons for each of the 10 failed CI runs were not read beyond the newest, where Windows jobs failed.", "Response times on older open issues were not sampled beyond the newest 30 items." ] }, "negative": 0, "verdict": "Puppeteer is a stable, Apache-2.0 library on 25.13.0, with ten releases since 27 July 2026, typed APIs, locators that wait and retry, and accessibility snapshots an agent can read. It has no MCP server or llms.txt of its own, and 10 of the 20 most recent CI runs on main failed between 7 and 13 October 2026.", "bestFor": "Agents that write and run Node.js scripts against Chrome or Firefox.", "strengths": [ "Ten releases from 25.4.0 on 27 July to 25.13.0 on 8 October 2026, each with a changelog generated by release-please", "TypeScript types for the whole API and a generated reference of 643 Markdown pages in the repository", "`page.accessibility.snapshot()` and the Locator API, which waits for elements and retries actions, suit scripted agent use", "Each release pins a tested Chrome for Testing and Firefox version, listed in a public support table", "Typed errors such as `TimeoutError`, `TargetCloseError` and `ConnectionClosedError` let a script tell timeouts from a closed browser" ], "weaknesses": [ "No MCP server, CLI or llms.txt of its own. The docs point agents to the separate chrome-devtools-mcp project", "10 of the 20 most recent CI runs on main, 7 to 13 October 2026, concluded in failure, the newest in Windows Chrome and Firefox jobs", "Page content reaches the agent unfiltered, and the docs have no prompt-injection or untrusted-content guidance", "JavaScript and TypeScript only, with Node.js 22.12 or later required since 25.0.0", "A stale workflow marks unconfirmed bug reports after 14 days and closes them 7 days later" ], "agentNotes": [ "Install with `npm i puppeteer`, which downloads a matching Chrome for Testing. Use `puppeteer-core` to bring your own browser", "Prefer `page.locator()` over `page.$()`. Locators wait for the element to be visible and stable before acting", "Read pages with `page.accessibility.snapshot({interestingOnly: true})` rather than full HTML to keep output short", "Catch `TimeoutError` separately from `TargetCloseError`. The first can be retried, the second needs a new page or browser", "Packages are ESM only since 25.0.0. Use `import puppeteer from 'puppeteer'` rather than `require`" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 89, "payments": 60, "reliability": 80, "schema": 81, "security": 52, "transparency": 72 }, "provenanceScore": 68 }, "connect": { "install": "npm i puppeteer" }, "letme": { "capability": "https://letme.dev/browser.control", "tool": "https://letme.dev/puppeteer" }, "notable": [ "Latest release 25.13.0 on 8 October 2026, pinned to Chrome for Testing 155.0.8059.39 and Firefox 157.0.1 (https://github.com/puppeteer/puppeteer/blob/main/docs/supported-browsers.md)", "25.0.0 on 12 May 2026 made the packages ESM only, raised the minimum to Node.js 22 and removed deprecated APIs, all listed under Breaking Changes (https://github.com/puppeteer/puppeteer/blob/main/packages/puppeteer-core/CHANGELOG.md)", "An experimental `page.webmcp` API reads and calls tools that pages register through WebMCP, in Chrome 151 or later behind a flag (https://pptr.dev/guides/webmcp)", "The docs home page points agents to chrome-devtools-mcp, a separate Puppeteer-based MCP server, for MCP use (https://github.com/puppeteer/puppeteer/blob/main/docs/index.md)", "SECURITY.md sends reports through Chromium's security process and says file writes and extension loading are intended behaviour, not vulnerabilities (https://github.com/puppeteer/puppeteer/blob/main/SECURITY.md)", "pptr.dev answers 404 for llms.txt, robots.txt and security.txt (checked 2026-10-14)" ], "area": "developer", "details": [ { "label": "Interfaces", "value": "Node.js library (`puppeteer` with a bundled browser, `puppeteer-core` without). No CLI or MCP server. `@puppeteer/browsers` is a separate CLI and library for installing browsers" }, { "label": "Protocols", "value": "Chrome DevTools Protocol for Chrome, WebDriver BiDi for Firefox and optionally Chrome (https://pptr.dev/webdriver-bidi)" }, { "label": "Runtimes", "value": "Node.js 22.12 or later, ESM only since 25.0.0. Chrome for Testing, chrome-headless-shell and stable Firefox" }, { "label": "Agent-relevant APIs", "value": "`page.locator()` with automatic waits, `page.accessibility.snapshot()`, request interception, screenshots and PDF, and the experimental `page.webmcp`" }, { "label": "Errors", "value": "`PuppeteerError` with subclasses `TimeoutError`, `ProtocolError`, `TargetCloseError`, `ConnectionClosedError` and `TouchError`" }, { "label": "Telemetry", "value": "None found in a search of the library source on 14 October 2026. The docs site pptr.dev loads Google Analytics" } ], "provenance": { "legalEntity": "Google LLC", "domain": "pptr.dev", "domainRegistered": "2018-05-23", "domainNote": "pptr.dev is the documentation site for Puppeteer, with a footer reading Copyright 2026 Google, Inc. RDAP gives a registration date of 23 May 2018. The repository is in the puppeteer organisation on GitHub. pptr.dev answers 404 for /.well-known/security.txt.", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/puppeteer/puppeteer/blob/main/packages/puppeteer-core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "No terms or privacy document governs this software beyond the Apache-2.0 licence, so `terms` and `privacy` are left out. The pptr.dev footer links Google's cookie policy for the site itself." ], "score": 68, "checks": [ { "check": "Legal entity named", "value": "Google LLC", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "pptr.dev, registered 2018-05-23 (8 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the Apache-2.0 licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/puppeteer.json" } }