Aura Autopilot vs Automation Anywhere

Aura Autopilot 50

Open-source software with paid parts around it, so the pricing lines are read for what a run needs. No payment protocol (0). TypeSafe publishes Jev's price per million input tokens and Aura's plans are public, Indie from $10 a month billed annually (20). Autopilot is free under Apache-2.0, and Aura's two-week trial needs no card (20). No Ramen account is needed with one's own keys, but a person installs the editor plugin and gets a TypeSafe key or signs in to Aura in a browser, so 10 rather than the self-hosted rule's 20 (10). 50 in all.

Automation Anywhere 15

No x402, MPP or L402 (0). No published prices for paid plans (0). Community Edition is free with no credit card required, but whether it includes API or MCP inbound access was not stated (15 of 20). A person signs up and an administrator creates the OAuth client (0).

Aura Autopilot 43

The launch post is dated 31 October 2026 and Aura 1.2.3 and 1.2.4 of 30 October 2026 ship Autopilot, so the last change is within 30 days (30). GitHub releases couldn't be read, and the two Aura release-note entries aren't three (0). Issue and pull-request replies couldn't be read; the project is days old, with Discord and support email as other channels (5 of 25). Not in the official MCP registry under any namespace (searched for autopilot and ramenvr) (0). Pinned dependencies, per-platform locks in packaging/, CI on three operating systems, conventional-commit checks and code-owner review (8 of 10). 43 in all.

Automation Anywhere 66

Cloud build 53728 went out on 7 October 2026 (30). Dated updates on 16 September, 5 October and 7 October 2026 (20). Public release notes and a community forum. Support was not tested (10 of 15). No official SDK and no entry in the official MCP registry (3 of 15). No package to assess (3 of 10).

Aura Autopilot 74

MCP reading. All 14 tools (start_run, wait, probe, run_harness, snapshot, describe_frames, restart_level, report, frames and five file tools) have JSON Schema inputs, read in autopilot/mcp.py, session.py, external.py and files.py (25). No llms.txt on www.tryaura.dev (404). The agent skill, INSTRUCTIONS.md and KIT.md are Markdown written for the agent, and the README and CONTRIBUTING.md are in the repository (7 of 10). Descriptions say what each tool does and when not to use it (frames is for a describer subagent only, describe_frames is a fallback), with server instructions (17 of 20). Required fields and an enum on kind, but report.outcome is a free string with its values only in the description, numeric ranges sit in descriptions rather than the schema, and probe takes free-form Python (9 of 15). Prompt examples in the README and skill, plain-language errors in the MCP server and documented exit codes for headless runs (11 of 15). Version numbers and a protocol version, but no public changelog, and GitHub release notes couldn't be read (5 of 15). 74 in all.

Automation Anywhere 55

Every Control Room serves Swagger at /swagger/, which needs a Control Room of one's own. The endpoint reference did not render in the pages we could fetch (15 of 25). llms.txt on the website covers marketing pages, and no Markdown docs or docs llms.txt were found (0). Overview pages describe each module's purpose and MCP tool pages say when to use each tool and what fails (10 of 20). MCP inbound variables are typed (String, Number, Boolean, List, Dictionary, DateTime, Record) and marked required or optional (9 of 15). The response code table lists only generic HTTP statuses, with tool troubleshooting notes (6 of 15). Versioned modules v1 to v4, dated deprecations and dated release notes (15).

Aura Autopilot 55

Apache-2.0 for the repository, with bundled fonts under the SIL OFL (30). The repository's code docstrings and the Unreal README say what is shared and how it is redacted, but docs/run-data.md, which they cite, isn't published. Aura's terms (TribeVR Inc., 25 June 2026) and privacy policy (27 August 2026) don't mention Autopilot, opt Aura customers into training by default with a perpetual licence to that data, and state no retention period. Runs with one's own keys go to Aura's endpoint under an install token with no account and no terms named. Sent data is never deleted (10 of 30). No deprecation policy; the protocol rule to add optional fields is a contributor guideline (6 of 20). Sharing is disclosed in the setup screen, the README and the plugin docs with three ways to turn it off, but it is on by default, the documentation page doesn't say so, and it includes the user's own agent conversation (12 of 20). 58 in all.

Automation Anywhere 74

Closed service with published website terms, an Intelligent Automation Agreement and product-specific terms (15). The privacy policy, modified 1 April 2026, gives retention rules such as up to 90 days for support data. No DPA or subprocessor list was read (16 of 30). A written API deprecation policy with minimum support and notice periods, and dated end-of-life notices (20). Regions are listed on the status site. Subprocessors were not found (8 of 20).

Aura Autopilot 53

Local-software reading, as tokeneconomizer was read: 30 for what leaves the machine and credentials, 20 approvals and sandboxing, 15 injection, 15 audit, 20 programme. Run sharing is on by default and sends recordings, screenshots, agent traces with the code the agent read and, for MCP runs, the user's own Claude Code or Codex conversation to app.tryaura.dev, after redacting secrets, paths, user and host names and email addresses. Keys sit in plain text in autopilot.env, the file tools never read *.env, and the localhost control endpoint carries a random secret (12). File tools write only the run's folder, notes.md and lib.py, and the user can stop or steer a run from the tab. autopilot connect codex sets default_tools_approval_mode to approve, and on Windows and macOS the sandbox is a plain child process without keys but with network and disk (10). sandbox.py names prompt injection from a game's code as the reason for the sandbox, and the frame describer is given only open questions (11). Each run keeps its agent log, harness versions, traces, decisions, report and recording, and the Feed tab shows activity (13). SECURITY.md asks for GitHub private vulnerability reporting; no security.txt on www.tryaura.dev (404), no bounty or certification found, advisories couldn't be read. Releases are signed and immutable, and pull requests need a code owner's approval (7). 53 in all.

Automation Anywhere 64

OAuth 2.0 bearer tokens or Authentication API tokens, with users authenticated through OIDC or SAML. No scopes beyond openid were documented for MCP (20 of 30). RBAC privileges such as View my bots and Run my bots limit discovery and runs, and missing required variables are prompted from the user (12 of 20). AI Governance logs for MCP inbound exist, with no prompt-injection guidance found (4 of 15). Audit log events for agent connection changes and every MCP-triggered run, plus an Audit API (15). A vulnerability disclosure policy with optional compensation and ISO 27001 and SOC 2 claimed on the website. No security.txt (13 of 20).

Aura Autopilot 69

MCP reading. 14 tools (15 for 11 to 30), with long descriptions on probe and run_harness and a long INSTRUCTIONS.md the skill says to read in full, with no toolsets (13 of 25). read_file takes offset and limit up to 2,000 lines, list_files returns at most 500, search at most 200 with a glob, frames up to 12 and run_harness takes seconds of play (16 of 20). Errors come back as isError with what to do next (open the editor, update the agent service, call wait), and headless runs exit 0, 1, 2 or 3 (16 of 20). readOnlyHint is set on the seven read tools and destructiveHint false on all, including probe, which the description says can change the game directly. One call runs at a time and a long one answers "still going" for wait to collect (14 of 20). Two required parameters on start_run with defaults of 10 minutes of exploration and a 30-minute limit; no SDKs, which a playtester doesn't need (10 of 15). 69 in all.

Automation Anywhere 60

Three standard MCP tools plus the inbound tools an administrator adds, and DiscoverAutomation returns at most nine matches (22 of 25). Filtering, sorting and pagination documented for list endpoints (20). Generic HTTP statuses with no documented error bodies. GetAutomationResult returns error details for failed runs (9 of 20). No idempotency key or MCP tool annotations found, with 409 for duplicates (4 of 20). Two-step auth before calls, case-sensitive JSON names, and no official SDK found (5 of 15).