Airtop vs Kane CLI

Airtop 24

Graded on the browser API. The newest published artefact is the Node SDK's 1.0.0-alpha2.47 on 1 July 2026, 99 days before the check. The stable 0.1.47 dates from 6 November 2025 and the docs changelog ends on 3 September 2025 (10). No three releases or dated entries in the last 90 days (0). Support is by Discord and email. On GitHub the Node SDK has an issue from February 2025 still open and six pull requests open since early 2025 (5). Official SDKs exist but the Python one was last released on 23 April 2025, and no Airtop server is in the MCP registry (6). Both SDK repositories carry CI workflows. Their results were not read (3).

Kane CLI 77

0.10.0 on npm on 28 October 2026, 4 days ago (30). 28 releases from 3 August to 1 November 2026, 0.8.4 to 0.10.0, each in the changelog (20). The repository has 337 commits, pull requests up to #222 merged within days by LambdaTest staff, a Discord and an issue tracker. GitHub's API wasn't reachable from this session, so open issues and reply times weren't counted (12 of 25). Not an MCP server. The CLI and skill are current on npm and a Homebrew tap, with no SDK (10 of 15). CI runs the skill installer's tests on Linux, macOS and Windows with Node 18 and 22. The CLI's own source and tests aren't public, and the main package carries no npm provenance attestation while the skill package does (5 of 10). Kane CLI is six and a half months old by its first npm release.

Airtop 62

A closed service with published terms of use (effective 28 July 2025). The SDKs are MIT per npm and PyPI (17). The privacy policy (updated 2 September 2025) keeps personal data as long as necessary, with no periods, and the site and FAQ say customer data is not used for AI training, by Airtop or its model suppliers. No public DPA or retention period for session data, recordings or profiles was found (12). No deprecation policy. Deprecated fields and two deprecated endpoints are marked in the reference with replacements and no dates (5). The privacy policy says hosting is in the United States, and the FAQ names OpenAI, Anthropic and Google as model suppliers. No subprocessor list was read, since the trust centre did not render (8).

Kane CLI 38

The editorial half. The wrapper, skill and docs are Apache-2.0. The runner, assurance and pinned Node binaries are labelled Apache-2.0 on npm with no source in the linked repository, and the service terms couldn't be read (12 of 30). The repository says what leaves the machine. Every run uploads to Test Manager with screenshots and an evidence pack recording the user's name and email, secrets are masked, credentials are stored with mode 0600, and the evidence viewer reads packs locally. The privacy policy, DPA and retention periods are on testmuai.com and weren't read (10 of 30). The changelog calls out breaking changes, such as the removal of the bare-objective shortcut in 0.4.1, but there's no deprecation policy or dated notice period (5 of 20). The changelog describes telemetry (a remote log, support ids, errors spooled and sent at exit) and a daily npm update check. The opt-out KANE_TELEMETRY=0 appears only in a skill reference, not the user guide (8 of 20).

Airtop 69

Graded as a hosted service, on the cloud browser API. status.airtop.ai runs on Instatus with 90 days of history, though it lists a single component, App (20). Between 10 July and 8 October 2026 it records no incident, only 30 minutes of scheduled maintenance on 18 August. A proxies incident of 5 hours 54 minutes on 1 July falls just outside the window (30). No request rate limit was found in the reviewed documentation. The pricing page gives simultaneous sessions per plan, 3, 30 and 100 (5). No 429 or backoff guidance and no idempotency keys were found. The SDK helpers retry twice by default and the CDP guides table a 503 for sessions that cannot be reached (4). No SLA found for any plan (0). The API is at /v1 and sessions and windows are not marked beta, though form filling is (10).

Kane CLI 50

Graded with the hosted lines, because every run, exploration and design job goes through TestMu AI's service and spends credits, and Exploration runs on HyperExecute. status.lambdatest.io (Statusfy) lists Kane CLI and KaneAI as their own components with incident history and an Atom feed (20). From 3 August to 1 November 2026 no incident names Kane CLI or KaneAI. The platform under it had test creation timeouts from 09:00 to 13:30 UTC on 28 September with slow Automation and HyperExecute starts, six hours of partial macOS HyperExecute degradation on 25 September, and real-device partial outages on 21 August and 22 October (57 minutes). Judgement call, 10 for multi-hour degradation of the service runs depend on. No request rate limit is published; the only numbers are Exploration's built-in limits (an hour, 400 actions or 800 model calls), 20 cloud browsers and a 15-minute real-device queue (5 of 15). No 429 or Retry-After guidance. maintain reconcile is documented as idempotent, Exploration refuses a second run with RUN_ACTIVE, and the skill says never to rerun a paid command just to get a support id (5 of 15). No SLA found; the terms weren't readable (0). Nothing in the repository labels Kane CLI or Exploration beta or preview (10).

Airtop 46

API keys from the portal, sent as a Bearer header on REST, CDP and Selenium, so no secret travels in a URL. Scopes, expiry and rotation were not found in the reviewed documentation, and the portal's key page sits behind login (18). No read-only keys or approval step. A person can log in through Live View so the agent never holds the password, profiles are encrypted at rest with AES-256, each browser runs in its own virtual machine per the docs, and credit thresholds cap a call (8). The API returns untrusted page content and runs models over it, and no prompt-injection guidance was found (0). Optional session recordings, a sessions page with logs in the portal, and credit usage and a request ID on every AI response (10). Airtop states SOC 2 Type II and HIPAA compliance with the report on request, and links a Vanta trust centre that did not render for us. No security.txt, disclosure policy or bug bounty was found (10).

Kane CLI 55

Two credential routes. OAuth with browser consent and token revocation on logout, scopes not documented; or the account's username and access key, which the docs say lets anyone holding it run tests on the account, passed as a command-line flag in CI. Not in a URL. 20 of 30 for revocable credentials without documented scopes. Exploration's read_only policy blocks write requests to any host and never presses Delete, Sign out or Pay, with --deny, --allow-domain and --allow-post, and the first mutating run in a project asks once on a terminal. The default is mutating, with no confirmation in agent mode (12 of 20). Results include text from the page under test. The 0.10.0 content fence masks secrets before they leave the worker, but no prompt-injection guidance was found (2 of 15). Every run lands in Test Manager with screenshots, evidence packs record steps and logs, and Exploration findings keep a history naming who changed what (13 of 15). SECURITY.md with security@testmuai.com, signed and notarised binaries per the README, npm registry signatures. No bug bounty, certification or security.txt could be checked, since testmuai.com wasn't readable, and SECURITY.md's supported versions list only 0.1.x (8 of 20).

Airtop 25

No x402, MPP or L402, and an unauthenticated request returned 401 (0). Plan prices are public, $0, $29, $189 and $558 a month with stated credit allowances, but the credits charged for browser time, proxy traffic and AI calls are not published, so plan-only (10). The Free plan renews 1,000 credits a month. Whether signup asks for a card is not stated on the pricing page or in the docs, so we award 15 of 20. A person has to sign up in a browser to get a key (0).

Kane CLI 20

No x402, MPP or L402 (0). Plan prices are public per the listing check of 1 November 2026 (Starter $17 a month billed annually, Pro $89), and run_end reports credits per run, but the credit price per run isn't published, so plan-only pricing (10). The release says "free to start" and the check found a 10,000-credit, 30-day trial; whether it needs a card couldn't be read today. Judgement call (10 of 20). A person signs up and approves OAuth in a browser, or copies an access key from the dashboard, before any run (0).