agent-browser vs AutoCua

agent-browser 84

Graded on the CLI and its MCP server. Every MCP tool has a JSON Schema input with additionalProperties false, and since 0.41.0 the full catalogue ships as @agent-browser/sandbox/mcp-tools.json (156 tools at 0.41.1), and agent-browser.schema.json covers the config file (25). llms.txt and a Markdown copy of each docs page at agent-browser.dev, re-read on 1 November (10). Tool descriptions are one line, such as Scroll the page or an element, with parameter descriptions that say when to omit a field. Few say when not to use a tool (12). Enums, minimums, defaults and required lists, with a free-form extraArgs string array on every tool (12). Many CLI examples and a --json result shape, with error codes such as tab_gone named in passing and no error catalogue found (10). Versioned releases and CHANGELOG.md for each (15). 25 + 10 + 12 + 12 + 10 + 15 = 84.

AutoCua 42

Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.

agent-browser 67

The tool needs no credential. Site passwords sit in a local vault encrypted with AES-256-GCM and are filled without reaching the model, while saved state files are plaintext unless a key is set (22 of 30). Domain allowlist, action policy file and confirmation for chosen action categories, all opt-in, with no restriction by default, though auto-discovered project config files can no longer set executables, browser arguments or plugins since 0.39.3 (16 of 20). Content boundary markers with a per-process nonce, output caps and a written threat model with known limitations, also opt-in (12 of 15). A local dashboard shows a command and result feed, with no persistent audit log found (7 of 15). No SECURITY.md in the repository on 1 November and no advisory on OSV, though 0.39.3, 0.40.0 and 0.41.0 fixed security flaws in the release notes. vercel.com's security.txt names HackerOne, per the 8 October check (10 of 20). 22 + 16 + 12 + 7 + 10 = 67.

AutoCua 38

Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.

agent-browser 80

The CLI adds no tool definitions to context, and the MCP server defaults to 29 core tools with eight further profiles and paged tools/list up to 156 at 0.41.1 (22 of 25). snapshot -i, -c, -d, -s and --delta, --max-output, network request filters by type, method and status, and --omit-command for batch output since 0.40.0 (20). Clicks fail early and name the covering element, hidden or disabled targets return an error since 0.39.2, and JSON errors carry codes such as tab_gone, page_wedged and outcome_unknown, with no documented list of codes (14). readOnlyHint and openWorldHint on every tool and no destructiveHint. Since 0.39.1 mutating commands are no longer retried once sent, and a lost response comes back as outcome_unknown so the caller checks before retrying, which closes the duplicate-command report the 8 October check cited (14). Refs and defaults keep commands short. One CLI, no SDK in a second language (10). 22 + 20 + 14 + 14 + 10 = 80.

AutoCua 55

Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.

agent-browser 48

Scored as local software. Official npm and Homebrew packages, Homebrew at 0.41.1 on 1 November 2026 with native binaries for five platforms, but crates.io still holds 0.19.0 from 14 March 2026 while the README lists cargo install (18 of 20). Public CI runs Rust tests on Linux, macOS and Windows plus native end-to-end tests. The ten most recent runs on main, 1 to 8 October 2026, concluded in failure, per the 8 October check. GitHub's API wasn't readable on 1 November, so the current state is unchecked (10 of 25). 840 open issues and pull requests and most of the newest without a reply, per the 8 October check. The three reports it named (#2032, #2056, #2031) were fixed in 0.39.1, 0.39.2 and 0.39.4, but the current issue list couldn't be read (10 of 25). Every release has a changelog entry and breaking changes get their own heading, on a 0.x line (10 of 15). 0.41.1 with a Labs badge and no stable declaration (0). 18 + 10 + 10 + 10 + 0 = 48.

AutoCua 25

Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.

agent-browser 63

Apache-2.0, copyright Vercel Inc. (30). No privacy statement for the software. The docs say where credentials, keys and state are stored, that saved state expires after 30 days by default, and that chat goes to the Vercel AI Gateway (18 of 30). No deprecation policy. The changelog flagged the -C snapshot flag as deprecated under a Breaking Changes heading (6 of 20). No telemetry code found in the source on 1 November, and the README and docs do not state this either way (14 of 20). 30 + 18 + 6 + 14 = 68.

AutoCua 42

MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.

agent-browser 70

0.41.1 on 30 October 2026 (30). 18 tagged releases in the 90 days from 3 August, 0.34.0 on 10 August to 0.41.1, read from a clone (20). 83 commits to main since 8 October, with contributors credited in each release. Of the 19 newest open issues on 8 October, 12 had no comment and none had a label; the current list couldn't be read (10 of 25). Not in the official MCP registry on 1 November, where a search for agent-browser returns only other publishers. Homebrew is current and crates.io is 22 minor versions behind (5 of 15). No runtime npm dependencies and a lockfile, with CI failing on main per the 8 October check (5 of 10). 30 + 20 + 10 + 5 + 5 = 70.

AutoCua 65

v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.