Aura Autopilot vs AutoHotkey

Aura Autopilot 53

Local-software reading, as tokeneconomizer was read: 30 for what leaves the machine and credentials, 20 approvals and sandboxing, 15 injection, 15 audit, 20 programme. Run sharing is on by default and sends recordings, screenshots, agent traces with the code the agent read and, for MCP runs, the user's own Claude Code or Codex conversation to app.tryaura.dev, after redacting secrets, paths, user and host names and email addresses. Keys sit in plain text in autopilot.env, the file tools never read *.env, and the localhost control endpoint carries a random secret (12). File tools write only the run's folder, notes.md and lib.py, and the user can stop or steer a run from the tab. autopilot connect codex sets default_tools_approval_mode to approve, and on Windows and macOS the sandbox is a plain child process without keys but with network and disk (10). sandbox.py names prompt injection from a game's code as the reason for the sandbox, and the frame describer is given only open questions (11). Each run keeps its agent log, harness versions, traces, decisions, report and recording, and the Feed tab shows activity (13). SECURITY.md asks for GitHub private vulnerability reporting; no security.txt on www.tryaura.dev (404), no bounty or certification found, advisories couldn't be read. Releases are signed and immutable, and pull requests need a code owner's approval (7). 53 in all.

AutoHotkey 24

No credential model. Scripts run with every right of the user who starts them, the closest case to one all-powerful key (10 of 30). No read-only mode, permission scoping or confirmation step for actions (3 of 20). Scripts read window text, controls and the clipboard, which can carry untrusted content, and no guidance on prompt injection was found (3 of 15). ListLines, KeyHistory and the debugger show what a script did, with no audit log (4 of 15). No SECURITY.md, no published advisories and no security.txt could be read. A code signing policy is linked from the home page and could not be read past the bot check (4 of 20).

Aura Autopilot 43

The launch post is dated 31 October 2026 and Aura 1.2.3 and 1.2.4 of 30 October 2026 ship Autopilot, so the last change is within 30 days (30). GitHub releases couldn't be read, and the two Aura release-note entries aren't three (0). Issue and pull-request replies couldn't be read; the project is days old, with Discord and support email as other channels (5 of 25). Not in the official MCP registry under any namespace (searched for autopilot and ramenvr) (0). Pinned dependencies, per-platform locks in packaging/, CI on three operating systems, conventional-commit checks and code-owner review (8 of 10). 43 in all.

AutoHotkey 72

2.0.30 on 9 October 2026 (30). 2.0.27 to 2.0.30 between 28 August and 9 October 2026, plus 2.1 alphas 31 to 35 (20). The changelog credits merged pull requests from outside contributors, but pull requests from 2022 to 2025 remain open with no decision, and the forum where bugs are reported could not be read (12 of 25). No MCP server or package registry entry. Release assets are current on GitHub (7 of 15). No CI and no dependency tooling in the repository (3 of 10).

Aura Autopilot 69

MCP reading. 14 tools (15 for 11 to 30), with long descriptions on probe and run_harness and a long INSTRUCTIONS.md the skill says to read in full, with no toolsets (13 of 25). read_file takes offset and limit up to 2,000 lines, list_files returns at most 500, search at most 200 with a glob, frames up to 12 and run_harness takes seconds of play (16 of 20). Errors come back as isError with what to do next (open the editor, update the agent service, call wait), and headless runs exit 0, 1, 2 or 3 (16 of 20). readOnlyHint is set on the seven read tools and destructiveHint false on all, including probe, which the description says can change the game directly. One call runs at a time and a long one answers "still going" for wait to collect (14 of 20). Two required parameters on start_run with defaults of 10 minutes of exploration and a 30-minute limit; no SDKs, which a playtester doesn't need (10 of 15). 69 in all.

AutoHotkey 46

The command line adds no tool definitions to context, but output is whatever the script writes, with no structured format (15 of 25). Output size and filtering are up to the script. Window functions take title, class, process and exclusion criteria (8 of 20). /ErrorStdOut puts load-time errors on stderr and /Validate exits non-zero on a load error, while runtime errors open a dialog unless the script uses OnError or try (12 of 20). Keystrokes and clicks cannot be safely retried and there is no dry run beyond /Validate (4 of 20). One executable, scripts on standard input with *, and an experimental DLL host. No SDK in a second language (7 of 15).

Aura Autopilot 55

Apache-2.0 for the repository, with bundled fonts under the SIL OFL (30). The repository's code docstrings and the Unreal README say what is shared and how it is redacted, but docs/run-data.md, which they cite, isn't published. Aura's terms (TribeVR Inc., 25 June 2026) and privacy policy (27 August 2026) don't mention Autopilot, opt Aura customers into training by default with a perpetual licence to that data, and state no retention period. Runs with one's own keys go to Aura's endpoint under an install token with no account and no terms named. Sent data is never deleted (10 of 30). No deprecation policy; the protocol rule to add optional fields is a contributor guideline (6 of 20). Sharing is disclosed in the setup screen, the README and the plugin docs with three ways to turn it off, but it is on by default, the documentation page doesn't say so, and it includes the user's own agent conversation (12 of 20). 58 in all.

AutoHotkey 76

The editorial half. GPL-2.0 on the repository and on the home page (30). No privacy statement for the software. A search of the interpreter source found no network code, and the docs describe the one optional update check (15 of 30). The README says v1 is not maintained, and deprecated switches such as /iLib are marked in the docs, with no dated deprecation policy (10 of 20). The update check is off by default and documented with its registry switch, and no telemetry was found (18 of 20). The provenance half is computed from the provenance block.

Aura Autopilot 41

Local-software reading, as a stdio MCP server with engine plugins. Official downloads per engine and OS from GitHub Releases, signed and listed in SHA256SUMS.txt, with Unreal 5.4 to 5.8, Unity 6000.0 or later, Godot 4.7 or later, Windows and macOS and Python 3.12 or later stated. The agent service isn't on a package registry; the plugin installs it, with uv and Bun, on first run (17 of 20). .github/workflows/ci.yml runs ruff and pytest on Linux, Windows and macOS with Python 3.12 and 3.13 plus a Codex end-to-end job, and CONTRIBUTING.md names download and uninstall end-to-end workflows. Whether runs pass wasn't checked, as github.com couldn't be read (15 of 25). Open issues couldn't be read, and the repository is days old (5 of 25). No changelog; releases are tagged v<version>-<commit>, the plugin protocol is versioned and the contributing rules say to add optional fields rather than change existing ones (4 of 15). Python package 0.1.0 and the Unreal plugin marked IsBetaVersion (0). 41 in all.

AutoHotkey 61

Read with the local-software lines, since the owner runs the interpreter. Official builds are a zip and a setup executable on GitHub releases for 32-bit and 64-bit Windows. The supported Windows versions were on autohotkey.com, which a bot check blocked, so not confirmed (18 of 20). The repository has no CI workflow and no test suite (0 of 25). GitHub Issues was disabled from 2017 until October 2026 and now shows one open issue and ten open pull requests, the oldest from 2022. Bug reports go to the forum, which we could not read (15 of 25). A dated changelog for every release. 2.0.x releases carry fixes only and additions go to 2.1 alphas, though the changelog records regressions such as one broken by v2.0.20 and fixed in 2.0.30 (13 of 15). Version 2.0 is the stable line (15).

Aura Autopilot 74

MCP reading. All 14 tools (start_run, wait, probe, run_harness, snapshot, describe_frames, restart_level, report, frames and five file tools) have JSON Schema inputs, read in autopilot/mcp.py, session.py, external.py and files.py (25). No llms.txt on www.tryaura.dev (404). The agent skill, INSTRUCTIONS.md and KIT.md are Markdown written for the agent, and the README and CONTRIBUTING.md are in the repository (7 of 10). Descriptions say what each tool does and when not to use it (frames is for a describer subagent only, describe_frames is a fallback), with server instructions (17 of 20). Required fields and an enum on kind, but report.outcome is a free string with its values only in the description, numeric ranges sit in descriptions rather than the schema, and probe takes free-form Python (9 of 15). Prompt examples in the README and skill, plain-language errors in the MCP server and documented exit codes for headless runs (11 of 15). Version numbers and a protocol version, but no public changelog, and GitHub release notes couldn't be read (5 of 15). 74 in all.

AutoHotkey 54

Graded as a scripting language driven from the command line. No machine-readable contract for the language or the command line (0 of 25). No llms.txt found, and the documentation is HTML in the AutoHotkeyDocs repository (0 of 10). 356 function reference pages state what each function does, its parameters and when it raises an error (17 of 20). Parameters are documented with types, defaults and allowed values, in a dynamically typed language (9 of 15). Every function page has examples, and errors raised are named per function, with the Error class hierarchy documented (13 of 15). Versioned releases and a dated changelog back to 2003 (15).