{
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-10-14",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.4",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run"
  },
  "tool": {
    "slug": "tab-bot",
    "name": "Tab",
    "vendor": "Terrasoft, Inc.",
    "vendorUrl": "https://tab.bot",
    "kind": "platform",
    "category": "personal-assistants",
    "summary": "Tab is a hosted AI assistant in private beta that people text in Messages. It has its own computer and browser, makes phone calls, works with connected accounts, and places orders or pays invoices after the owner approves.",
    "url": "https://www.anchorterminal.com/tools/tab-bot",
    "markdownUrl": "https://www.anchorterminal.com/tools/tab-bot.md",
    "slimMarkdownUrl": "https://www.anchorterminal.com/tools/tab-bot.min.md",
    "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/tab-bot.json",
    "license": "Closed service under Tab's Terms of Use (Terrasoft, Inc., effective 2 September 2026).",
    "transports": [],
    "packages": [],
    "auth": "mixed",
    "authNotes": "Join the waitlist with a name and mobile number. Account access starts with a code sent to the verified number, and web sessions use HttpOnly SameSite cookies with only a keyed hash stored (https://tab.bot and https://tab.bot/security). Connected accounts use the provider's own authorisation flow, and write actions are denied by default unless the exact action is enabled (https://tab.bot/security).",
    "pricing": "paid",
    "pricingNotes": "No price or plan was published on tab.bot, checked 14 October 2026. The terms cover purchases the owner approves but name no subscription fee. The value of this field is unconfirmed.",
    "priceSummary": "Paid",
    "where": "local",
    "x402": {
      "level": "no",
      "evidence": "No x402, MPP or L402 found on tab.bot, its terms or security page, checked 14 October 2026.",
      "endpoints": []
    },
    "toolCount": null,
    "popularity": {
      "githubStars": null,
      "npmWeekly": null,
      "pypiWeekly": null,
      "asOf": "2026-10-14"
    },
    "capabilities": [
      "assistant.messaging",
      "assistant.memory",
      "messaging.rcs",
      "messaging.inbound",
      "browser.hosted",
      "voice.calls",
      "commerce.checkout",
      "payments.card-token",
      "memory.user"
    ],
    "tags": [
      "hosted",
      "official",
      "closed-source",
      "paid",
      "waitlist"
    ],
    "graded": true,
    "disclosure": "Tab competes with LocalGhost, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.",
    "competesWith": "localghost",
    "anchor": {
      "graded": true,
      "score": 10.7,
      "grade": "F",
      "agentReady": false,
      "rank": 1003,
      "ranked": true,
      "rankOf": 1010,
      "categoryRank": 37,
      "methodology": "0.4",
      "run": "2026-10-01",
      "scores": {
        "ergonomics": 0,
        "maintenance": 58,
        "payments": 0,
        "reliability": 5,
        "schema": 0,
        "security": 4,
        "transparency": 45
      },
      "pending": [
        "performance",
        "tasks"
      ],
      "breakdown": [
        {
          "key": "reliability",
          "name": "Reliability",
          "weight": 16,
          "effectiveWeight": 20,
          "score": 5,
          "points": 1,
          "reason": "Read with the hosted lines. No status page found (0). No readable incident history (5). No limits published (0). No overload or retry guidance (0). No SLA found (0). Private beta behind a waitlist, which the Dots listing scored 0 for a gradual rollout (0)."
        },
        {
          "key": "performance",
          "name": "Performance",
          "weight": 10,
          "effectiveWeight": 0,
          "pending": true,
          "points": 0,
          "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes."
        },
        {
          "key": "schema",
          "name": "Schema \u0026 documentation",
          "weight": 13,
          "effectiveWeight": 16.25,
          "score": 0,
          "points": 0,
          "reason": "Graded on the interface an outside agent can use, as GRADER.md asks. Tab has no API, MCP server or A2A endpoint for an agent, so the contract, description, typed-input and example lines score nothing (0 of 25, 0 of 20, 0 of 15, 0 of 15). That is a statement about agent access, not about the product for people. tab.bot/llms.txt returns 404 and no Markdown docs for agents were found (0). The versioning and changelog line versions an agent interface, and with none there is nothing to version, so it scores nothing (0 of 15). This is the reading the 12 October auditor applied to every listing without an agent interface, and app release notes count under maintenance instead."
        },
        {
          "key": "ergonomics",
          "name": "Agent ergonomics",
          "weight": 13,
          "effectiveWeight": 16.25,
          "score": 0,
          "points": 0,
          "reason": "Graded on the interface an outside agent can use. Tab has none, so context cost, pagination, errors, retries and defaults have nothing to score (0 on each line). This says nothing about the product for people."
        },
        {
          "key": "security",
          "name": "Security \u0026 auth",
          "weight": 14,
          "effectiveWeight": 17.5,
          "score": 4,
          "points": 0.7,
          "reason": "Graded on the interface an outside agent can use. With none for Tab, the credential, least-privilege, injection and audit lines score nothing (0 of 30, 0 of 20, 0 of 15, 0 of 15), whatever the service does for its owner. The security programme line doesn't need an interface and is scored. For the record, the security page sets out saved passwords encrypted with AES-256-GCM and filled inside a separate boundary, masked screenshots, write actions denied unless the exact action is enabled, and checkout bound to the approved cart and exact total and charged once. The security page, last reviewed on 21 August 2026, asks for reports by email with the subject Security to an address that decodes to privacy@tab.bot. No security.txt (404), bug bounty, certification or advisories found. A reporting route on a security page is a little more than Instinct's 3 for a support address in security.txt (4 of 20)."
        },
        {
          "key": "payments",
          "name": "Payments \u0026 pricing",
          "weight": 10,
          "effectiveWeight": 12.5,
          "score": 0,
          "points": 0,
          "reason": "Read with the hosted rule. No x402, MPP or L402 (0). No price or plan is published on tab.bot (0). No free plan or trial is stated, and access is by waitlist (0). A person joins the waitlist with a name and mobile number (0)."
        },
        {
          "key": "tasks",
          "name": "Task success",
          "weight": 10,
          "effectiveWeight": 0,
          "pending": true,
          "points": 0,
          "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored."
        },
        {
          "key": "maintenance",
          "name": "Maintenance \u0026 community",
          "weight": 7,
          "effectiveWeight": 8.75,
          "score": 58,
          "points": 5.08,
          "reason": "Read for a closed service. The updates page's latest entries are dated 14 September 2026, 30 days before this check (30). One grader read dated entries on eight days from 4 to 14 September 2026, and the lister's read of the same day agrees on the latest date. tab.bot refused the other grader's requests with 403 and the auditor didn't request it, so the count rests on that read (20). A public updates page and a reporting route on the security page, untested, below the 10 given to near-daily changelogs with an address (8 of 15). No MCP server or SDK (0). No package or CI to judge (0)."
        },
        {
          "key": "transparency",
          "name": "Transparency \u0026 trust",
          "weight": 7,
          "effectiveWeight": 8.75,
          "score": 45,
          "points": 3.94,
          "note": "editorial 30, provenance 59",
          "reason": "Closed service under terms effective 2 September 2026 naming Terrasoft, Inc. (15). The privacy policy, effective the same day, names providers by category and says nothing on training models with user content, and the home page loads Meta and TikTok pixels and other attribution scripts. No retention periods were found (10 of 30). No deprecation policy or dated notices found (2 of 20). Providers by category only, with no names or regions, the Instinct dossier's 3 (3 of 20)."
        }
      ],
      "assessment": {
        "date": "2026-10-14",
        "basis": "public evidence",
        "confidence": "low",
        "notes": {
          "ergonomics": "Graded on the interface an outside agent can use. Tab has none, so context cost, pagination, errors, retries and defaults have nothing to score (0 on each line). This says nothing about the product for people.",
          "maintenance": "Read for a closed service. The updates page's latest entries are dated 14 September 2026, 30 days before this check (30). One grader read dated entries on eight days from 4 to 14 September 2026, and the lister's read of the same day agrees on the latest date. tab.bot refused the other grader's requests with 403 and the auditor didn't request it, so the count rests on that read (20). A public updates page and a reporting route on the security page, untested, below the 10 given to near-daily changelogs with an address (8 of 15). No MCP server or SDK (0). No package or CI to judge (0).",
          "payments": "Read with the hosted rule. No x402, MPP or L402 (0). No price or plan is published on tab.bot (0). No free plan or trial is stated, and access is by waitlist (0). A person joins the waitlist with a name and mobile number (0).",
          "reliability": "Read with the hosted lines. No status page found (0). No readable incident history (5). No limits published (0). No overload or retry guidance (0). No SLA found (0). Private beta behind a waitlist, which the Dots listing scored 0 for a gradual rollout (0).",
          "schema": "Graded on the interface an outside agent can use, as GRADER.md asks. Tab has no API, MCP server or A2A endpoint for an agent, so the contract, description, typed-input and example lines score nothing (0 of 25, 0 of 20, 0 of 15, 0 of 15). That is a statement about agent access, not about the product for people. tab.bot/llms.txt returns 404 and no Markdown docs for agents were found (0). The versioning and changelog line versions an agent interface, and with none there is nothing to version, so it scores nothing (0 of 15). This is the reading the 12 October auditor applied to every listing without an agent interface, and app release notes count under maintenance instead.",
          "security": "Graded on the interface an outside agent can use. With none for Tab, the credential, least-privilege, injection and audit lines score nothing (0 of 30, 0 of 20, 0 of 15, 0 of 15), whatever the service does for its owner. The security programme line doesn't need an interface and is scored. For the record, the security page sets out saved passwords encrypted with AES-256-GCM and filled inside a separate boundary, masked screenshots, write actions denied unless the exact action is enabled, and checkout bound to the approved cart and exact total and charged once. The security page, last reviewed on 21 August 2026, asks for reports by email with the subject Security to an address that decodes to privacy@tab.bot. No security.txt (404), bug bounty, certification or advisories found. A reporting route on a security page is a little more than Instinct's 3 for a support address in security.txt (4 of 20).",
          "transparency": "Closed service under terms effective 2 September 2026 naming Terrasoft, Inc. (15). The privacy policy, effective the same day, names providers by category and says nothing on training models with user content, and the home page loads Meta and TikTok pixels and other attribution scripts. No retention periods were found (10 of 30). No deprecation policy or dated notices found (2 of 20). Providers by category only, with no names or regions, the Instinct dossier's 3 (3 of 20)."
        },
        "sources": [
          {
            "what": "home page",
            "url": "https://tab.bot",
            "seen": "2026-10-14"
          },
          {
            "what": "security page",
            "url": "https://tab.bot/security",
            "seen": "2026-10-14"
          },
          {
            "what": "updates",
            "url": "https://tab.bot/updates",
            "seen": "2026-10-14"
          },
          {
            "what": "terms",
            "url": "https://tab.bot/terms",
            "seen": "2026-10-14"
          },
          {
            "what": "privacy policy",
            "url": "https://tab.bot/privacy",
            "seen": "2026-10-14"
          },
          {
            "what": "robots.txt",
            "url": "https://tab.bot/robots.txt",
            "seen": "2026-10-14"
          },
          {
            "what": "status subdomain DNS lookup",
            "url": "https://dns.google/resolve?name=status.tab.bot\u0026type=A",
            "seen": "2026-10-14"
          }
        ],
        "openQuestions": [
          "unchecked by the auditor: tab.bot, which answered 403 to ClaudeBot on 14 October 2026. The updates count rests on one grader's read and the lister's.",
          "Price and plans after the private beta.",
          "Whether user content trains models, which the privacy policy doesn't address."
        ]
      },
      "negative": 0,
      "verdict": "Tab is a private-beta texting assistant with a detailed security page on credential isolation and checkout binding, and a public updates page. No outside agent can call it, no price is published, and its privacy policy says nothing on training with user content.",
      "bestFor": "A person who wants a texting assistant that browses, calls and buys with tight checkout controls.",
      "disclosure": "Tab competes with LocalGhost, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.",
      "strengths": [
        "Saved passwords are encrypted and filled inside a separate boundary, with only an opaque ID passed to the AI.",
        "Checkout is bound to the merchant, cart, recipient and exact total, and a charge is attempted once.",
        "Write actions on connected accounts are denied by default unless the exact action is enabled.",
        "Dated updates on eight days in September 2026."
      ],
      "weaknesses": [
        "Private beta behind a waitlist.",
        "No API, MCP server or A2A endpoint for an outside agent.",
        "No price or plan published.",
        "The privacy policy says nothing on training with user content, and the home page loads ad pixels."
      ],
      "agentNotes": [
        "Don't plan to call Tab from another agent. It answers only the owner's Messages or WhatsApp thread.",
        "Tell the owner that access needs a waitlist place and no price is published."
      ],
      "metrics": {
        "kind": "remote",
        "measured": false
      },
      "reviewCount": 0,
      "avgRating": 0,
      "history": [
        {
          "basis": "public evidence",
          "confidence": "low",
          "grade": "F",
          "methodology": "0.4",
          "pending": [
            "performance",
            "tasks"
          ],
          "run": "2026-10-01",
          "runLabel": "October 2026 research run",
          "score": 10.7
        }
      ],
      "editorialScores": {
        "ergonomics": 0,
        "maintenance": 58,
        "payments": 0,
        "reliability": 5,
        "schema": 0,
        "security": 4,
        "transparency": 30
      },
      "provenanceScore": 59
    },
    "connect": {},
    "letme": {
      "capability": "https://letme.dev/assistant.messaging",
      "tool": "https://letme.dev/tab-bot"
    },
    "notable": [
      "Tab is in private beta behind a waitlist (https://tab.bot)",
      "Before it spends, the owner sees what is being bought, the total and who gets paid, and nothing is paid until the owner approves (https://tab.bot)",
      "Saved website passwords are encrypted with AES-256-GCM and filled inside a separate boundary. The AI receives an opaque credential ID, and password, code, token and payment fields are masked before screenshots (https://tab.bot/security)",
      "Checkout is bound to the user, task, merchant, cart, recipient, currency, exact total, payment-frame origins, card and deadline, rechecked before filling, and a charge is attempted once. Wallet and automated checkout are in a limited beta (https://tab.bot/security)",
      "Tab can call hotels, doctors' offices, restaurants and vendors, wait on hold and report back (https://tab.bot)",
      "No statement on training models with user content was found in the privacy policy or terms (https://tab.bot/privacy)",
      "The updates page has dated entries through 14 September 2026 (https://tab.bot/updates)",
      "The home page loads Meta and TikTok pixels and other attribution scripts (page source of https://tab.bot)"
    ],
    "area": "frameworks",
    "details": [
      {
        "label": "Surface listed",
        "value": "Tab, read from tab.bot, the security page, terms, privacy policy and updates page on 14 October 2026. No waitlist entry was made."
      },
      {
        "label": "Where it runs",
        "value": "A cloud service. Providers are named only by category in the privacy policy (https://tab.bot/privacy)."
      },
      {
        "label": "What it acts on",
        "value": "Websites through its own browser, phone calls, connected accounts, files and media, purchases, reservations and invoice payments (https://tab.bot)."
      },
      {
        "label": "Outside agent access",
        "value": "None found."
      },
      {
        "label": "Access",
        "value": "Private beta. Joining the waitlist needs a name and a mobile number (https://tab.bot)."
      },
      {
        "label": "Security contact",
        "value": "The security page says to email with the subject line Security. The address on the page decodes to privacy@tab.bot (https://tab.bot/security)."
      },
      {
        "label": "Eligibility",
        "value": "18 or the age of majority (https://tab.bot/terms)."
      }
    ],
    "provenance": {
      "legalEntity": "Terrasoft, Inc.",
      "domain": "tab.bot",
      "domainRegistered": "2026-08-21",
      "endpointOnVendorDomain": null,
      "terms": "https://tab.bot/terms",
      "privacy": "https://tab.bot/privacy",
      "statusPage": "",
      "changelog": "https://tab.bot/updates",
      "securityTxt": "none",
      "checked": "2026-10-14",
      "notes": [
        "The terms and privacy policy name Terrasoft, Inc. and are effective 2 September 2026. The security page was last reviewed on 21 August 2026.",
        "tab.bot/.well-known/security.txt and llms.txt return 404. No status page was found.",
        "RDAP gives a registration date of 2026-08-21 for tab.bot."
      ],
      "score": 59,
      "checks": [
        {
          "check": "Legal entity named",
          "value": "Terrasoft, Inc.",
          "points": 20,
          "max": 20,
          "state": "ok"
        },
        {
          "check": "Domain age",
          "value": "tab.bot, registered 2026-08-21 (under a year)",
          "points": 0,
          "max": 15,
          "state": "no"
        },
        {
          "check": "Endpoint on the vendor's domain",
          "value": "no hosted endpoint",
          "points": 0,
          "max": 0,
          "state": "na"
        },
        {
          "check": "Terms of service",
          "value": "published",
          "points": 10,
          "max": 10,
          "state": "ok"
        },
        {
          "check": "Privacy policy",
          "value": "published",
          "points": 10,
          "max": 10,
          "state": "ok"
        },
        {
          "check": "Status page",
          "value": "not found",
          "points": 0,
          "max": 10,
          "state": "no"
        },
        {
          "check": "Changelog",
          "value": "published",
          "points": 10,
          "max": 10,
          "state": "ok"
        },
        {
          "check": "security.txt",
          "value": "not found",
          "points": 0,
          "max": 10,
          "state": "no"
        }
      ]
    },
    "pageJsonUrl": "https://www.anchorterminal.com/tools/tab-bot.json"
  }
}