Anchor Browser vs AutoCua

Anchor Browser 77

Graded as a hosted service. status.anchorbrowser.io runs on incident.io with two components, Website and Anchor Application (20). Both show operational on 1 November, and the RSS feed is still empty. The page has recorded no incident since it was set up in June 2025. This run reads a readable page that has never posted an incident as a clean record at 20, as for quicken-simplifi, outline and linkup, where the 8 October check gave 25, a value the checklist doesn't name (20). Limits are published, 5, 25 and 100 session creations a minute and 5, 25 and 200 concurrent browsers by plan, and 2,000 requests a minute on Web Unlocker (15). The OpenAPI document declares 429 on ten operations, with RateLimit and Retry-After headers on session creation, and the Web Unlocker docs say to retry 429, 500, 503 and 504 with exponential backoff. The sessions guide now says a 429 from the per-minute limiter comes before a session exists, so retrying it doesn't create a second one, that the API reads no Idempotency-Key, so retrying a 5xx or 409 can, and which statuses are terminal. Safe-retry guidance without idempotency keys, read as e2b's (12). No SLA was found on the pricing page, the docs or the site (0). The API is version 1.0.0, the SDKs are 1.0 and nothing marks the sessions API as beta (10). 20 + 20 + 15 + 12 + 0 + 10 = 77.

AutoCua 25

Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.

Anchor Browser 80

OpenAPI 3.1.0 at docs.anchorbrowser.io/openapi.yaml with 101 paths and 136 operations, unchanged on 1 November, and the anchor-api-key header scheme (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). All 136 operations carry a description, the spec's introduction says which resource suits which job, and a docs page compares the task types. Few descriptions say when not to use an endpoint (16). Inputs are typed with 90 enum declarations and named request schemas. We did not audit every field for bounds (11). The spec holds 121 examples and declares 400, 401, 404 and 500 widely, with one shared error schema of code and message (12). Paths are versioned under /v1 and a legacy spec is kept. No API changelog was found, docs.anchorbrowser.io/changelog still returns 404 on 1 November, and the SDK changelog stops at 1.0.0-dev.4 (6). 25 + 10 + 16 + 11 + 12 + 6 = 80.

AutoCua 42

Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.

Anchor Browser 30

No machine payment protocol was confirmed on Anchor's own endpoints. A blog post dated 29 August 2025 shows x402 on POST /v1/sessions, but our unpaid request on 1 November 2026 returned 401 "Unauthorized, please log in.", as on 8 October, and the docs don't describe it. The session option named x402 lets a browser pay other sites (0). Per-browser, per-hour, per-GB, per-step and, now, per-run prices for Automation Tasks (0.1 credits, $0.10, with failed runs not charged the task fee) are published without login (20). The Free plan has $5 of credits a month. Agent Access, which granted 1 credit with no account and no card, answered "Agent Access is disabled" on 1 November, and whether dashboard sign-up asks for a card wasn't read, so half, as smartsheet's unconfirmed trial (10). With Agent Access disabled, a key comes from a dashboard account at app.anchorbrowser.io, which a person creates in a browser (0). 0 + 20 + 10 + 0 = 30.

AutoCua 60

Free self-hosted package with nothing to buy: 0 + 20 + 20 + 20 = 60.

Anchor Browser 73

The main MCP server lists about 24 tools and reaches the other REST routes through list_endpoints, get_endpoint and two call tools. Browser control and per-site actions are separate servers, and the docs warn that /v1/mcp/actions without a domain lists thousands of tools. 15 for the tool count plus 5 for the split servers (20). Session lists take page, limit, sort, search and filters by status, tag, domain and date, volumes use a cursor, and webhook deliveries take limit and offset (17). Errors return an integer code and a message, 402 marks exhausted credits, and Agent Access errors name the next call. No stable machine-readable error codes were found (13). No idempotency keys. The MCP server splits call_endpoint_read from call_endpoint_write, and batch sessions have a retry-failed call. Tool annotations were not read because the server needs a key (8). A session starts from an empty body, and the SDKs cover TypeScript and Python (15). 20 + 17 + 13 + 8 + 15 = 73.

AutoCua 55

Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.

Anchor Browser 54

API keys in the anchor-api-key header, per project. The MCP servers also accept OAuth through signin.anchorbrowser.io with mcp:tools and mcp:admin scopes. No key scopes, expiry or rotation guidance were found in the docs (22). The documented CDP connection passes the key as apiKey in the wss://connect.anchorbrowser.io URL, a secret in a query string (minus 10). No read-only API key. Live view has a read-only mode, volumes mount read-only, secrets can be limited to matching domains, identities sign in without returning credentials, and tasks can pause for a person's input (13). No prompt-injection guidance was found in the docs. Secret values and sensitive data masking keep credentials out of the model's view, which is a partial mitigation (4). Recordings, session history, webhook delivery logs and a billing endpoint give the operator a trail. The audit logs on the security page are restricted to Anchor's staff (11). SOC 2 Type 2, ISO 27001 and HIPAA per the security page and trust portal, with reports behind an access request, and a disclosure contact in the SDK's SECURITY.md. No security.txt (404 again on 1 November) or bug bounty was found (14). The documented CDP URL still carries apiKey on 1 November. 22 - 10 + 13 + 4 + 11 + 14 = 54.

AutoCua 38

Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.

Anchor Browser 53

The service is closed. The SDKs and the self-hosted MCP server are Apache-2.0. The only terms published are a website terms of use dated 16 March 2025, which grants personal, non-commercial use of the site and does not cover the API, so the terms for the paid service are unclear (8). The security page says session data is not stored and each browser's virtual machine is destroyed, the pricing page gives 7 days of data retention, recordings are on by default, and Zero Data Retention is by request. The privacy policy (24 February 2026) covers the website and customer contacts, with one product section on Gmail access. The DPA and data handling policy sit behind an access request (15). The legacy tasks API and the old MCP address are labelled and still work, and the SDK has a migration guide. No deprecation policy or dates (5). The security page names AWS us-east-2 and eu-central-1. The trust portal has a subprocessor section, of which our reader saw only OpenAI and Anthropic (12). Terms and privacy policy dates unchanged on 1 November. 8 + 15 + 5 + 12 = 40.

AutoCua 42

MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.