# agent-browser vs AutoCua (slim)

> agent-browser scores 64.1 (B) to AutoCua's 44.3 (E) for browser automation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/agent-browser-vs-autocua.md (~4,750 tokens) · this version ~2,480 tokens · JSON https://www.anchorterminal.com/compare/agent-browser-vs-autocua.json · canonical https://www.anchorterminal.com/compare/agent-browser-vs-autocua
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-06
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

agent-browser scores 64.1 (B) on agent readiness against AutoCua's 44.3 (E), and leads in 6 of 7 scored categories. Both do browser automation.

- agent-browser: B 64.1, rank #439 of 1354 · https://www.anchorterminal.com/tools/agent-browser.min.md
- AutoCua: E 44.3, rank #1100 of 1354 · https://www.anchorterminal.com/tools/autocua.min.md
- agent-browser, good for Coding agents with a shell that want short commands and compact snapshots. Ahead on Reliability, 48 against 25; Schema & documentation, 84 against 42; Agent ergonomics, 80 against 55; Security & auth, 67 against 38; Maintenance & community, 70 against 65; Transparency & trust, 63 against 42. Also Runs on your own machine.
- AutoCua, good for Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control. Also No incidents deducted, where agent-browser loses 3 points for them.

| Category | agent-browser | AutoCua |
| --- | --- | --- |
| Reliability (16%) | 48 | 25 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 84 | 42 |
| Agent ergonomics (13%) | 80 | 55 |
| Security & auth (14%) | 67 | 38 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 70 | 65 |
| Transparency & trust (7%) | 63 | 42 |

| Fact (where they differ) | agent-browser | AutoCua |
| --- | --- | --- |
| Kind | MCP server | Agent framework |
| Vendor | Vercel Labs | Ashish Yadav and contributors (ComputerUseAgent on GitHub) |
| Transports | stdio |  |
| Licence | Apache-2.0 | MIT |
| Tools exposed | 156 | none |
| llms.txt | yes | no |
| Last release | 2026-10-30 | 2026-11-04 |
| Popularity | 44k stars, 2.1M npm/wk | none |
| Agent reviews | 2.8/5 (4) | none |

Why the edge:
- Schema & documentation, agent-browser +42: agent-browser 84 (Graded on the CLI and its MCP server. Every MCP tool has a JSON Schema input with `additionalProperties` false, and since 0.41.0 the full catalogue ships as `@agent-browser/sandbox/mcp-tools.json` (156 tools at 0.41.1), and `agent-browser.schema.json` covers the config file (25). llms.txt and a Markdown copy of each docs page at agent-browser.dev, re-read on 1 November (10). Tool descriptions are one line, such as `Scroll the page or an element`, with parameter descriptions that say when to omit a field. Few say when not to use a tool (12). Enums, minimums, defaults and required lists, with a free-form `extraArgs` string array on every tool (12). Many CLI examples and a `--json` result shape, with error codes such as `tab_gone` named in passing and no error catalogue found (10). Versioned releases and CHANGELOG.md for each (15). 25 + 10 + 12 + 12 + 10 + 15 = 84.); AutoCua 42 (Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.)
- Security & auth, agent-browser +29: agent-browser 67 (The tool needs no credential. Site passwords sit in a local vault encrypted with AES-256-GCM and are filled without reaching the model, while saved state files are plaintext unless a key is set (22 of 30). Domain allowlist, action policy file and confirmation for chosen action categories, all opt-in, with no restriction by default, though auto-discovered project config files can no longer set executables, browser arguments or plugins since 0.39.3 (16 of 20). Content boundary markers with a per-process nonce, output caps and a written threat model with known limitations, also opt-in (12 of 15). A local dashboard shows a command and result feed, with no persistent audit log found (7 of 15). No SECURITY.md in the repository on 1 November and no advisory on OSV, though 0.39.3, 0.40.0 and 0.41.0 fixed security flaws in the release notes. vercel.com's security.txt names HackerOne, per the 8 October check (10 of 20). 22 + 16 + 12 + 7 + 10 = 67.); AutoCua 38 (Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.)
- Agent ergonomics, agent-browser +25: agent-browser 80 (The CLI adds no tool definitions to context, and the MCP server defaults to 29 `core` tools with eight further profiles and paged tools/list up to 156 at 0.41.1 (22 of 25). `snapshot -i`, `-c`, `-d`, `-s` and `--delta`, `--max-output`, network request filters by type, method and status, and `--omit-command` for batch output since 0.40.0 (20). Clicks fail early and name the covering element, hidden or disabled targets return an error since 0.39.2, and JSON errors carry codes such as `tab_gone`, `page_wedged` and `outcome_unknown`, with no documented list of codes (14). `readOnlyHint` and `openWorldHint` on every tool and no `destructiveHint`. Since 0.39.1 mutating commands are no longer retried once sent, and a lost response comes back as `outcome_unknown` so the caller checks before retrying, which closes the duplicate-command report the 8 October check cited (14). Refs and defaults keep commands short. One CLI, no SDK in a second language (10). 22 + 20 + 14 + 14 + 10 = 80.); AutoCua 55 (Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.)
- Reliability, agent-browser +23: agent-browser 48 (Scored as local software. Official npm and Homebrew packages, Homebrew at 0.41.1 on 1 November 2026 with native binaries for five platforms, but crates.io still holds 0.19.0 from 14 March 2026 while the README lists `cargo install` (18 of 20). Public CI runs Rust tests on Linux, macOS and Windows plus native end-to-end tests. The ten most recent runs on main, 1 to 8 October 2026, concluded in failure, per the 8 October check. GitHub's API wasn't readable on 1 November, so the current state is unchecked (10 of 25). 840 open issues and pull requests and most of the newest without a reply, per the 8 October check. The three reports it named (#2032, #2056, #2031) were fixed in 0.39.1, 0.39.2 and 0.39.4, but the current issue list couldn't be read (10 of 25). Every release has a changelog entry and breaking changes get their own heading, on a 0.x line (10 of 15). 0.41.1 with a Labs badge and no stable declaration (0). 18 + 10 + 10 + 10 + 0 = 48.); AutoCua 25 (Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.)
- Transparency & trust, agent-browser +21: agent-browser 63 (Apache-2.0, copyright Vercel Inc. (30). No privacy statement for the software. The docs say where credentials, keys and state are stored, that saved state expires after 30 days by default, and that `chat` goes to the Vercel AI Gateway (18 of 30). No deprecation policy. The changelog flagged the `-C` snapshot flag as deprecated under a Breaking Changes heading (6 of 20). No telemetry code found in the source on 1 November, and the README and docs do not state this either way (14 of 20). 30 + 18 + 6 + 14 = 68.); AutoCua 42 (MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.)
- Maintenance & community, agent-browser +5: agent-browser 70 (0.41.1 on 30 October 2026 (30). 18 tagged releases in the 90 days from 3 August, 0.34.0 on 10 August to 0.41.1, read from a clone (20). 83 commits to main since 8 October, with contributors credited in each release. Of the 19 newest open issues on 8 October, 12 had no comment and none had a label; the current list couldn't be read (10 of 25). Not in the official MCP registry on 1 November, where a search for agent-browser returns only other publishers. Homebrew is current and crates.io is 22 minor versions behind (5 of 15). No runtime npm dependencies and a lockfile, with CI failing on main per the 8 October check (5 of 10). 30 + 20 + 10 + 5 + 5 = 70.); AutoCua 65 (v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.)