AutoCua vs Browser Use

AutoCua 25

Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.

Browser Use 87

Graded as a hosted service, on Browser Use Cloud. status.browser-use.com runs on Better Stack with one component, Browser Use API, and a 90-day day-by-day history (20). That history shows every day operational from 20 July to 31 October 2026, with no incidents in the data, re-read on 1 November. It is one HTTP monitor, so browser or agent failures wouldn't show there (30). Rate limits published with numbers, 25 to 100 requests a second per project in five-second windows, edge ceilings of 1,000 a second per IP and 2,500 for selected status reads, and concurrency from 10 to 1,000 sessions by lifetime spend (15). 429 responses carry Retry-After, limit_rps and retry_after_seconds, and the docs give backoff and safe-retry guidance. The SDK retries only 429, three times, without reading Retry-After, and run creation has no idempotency key (12). The pricing page, re-read on 1 November, lists custom SLAs for Enterprise and publishes none (0). API V4 is the current API. The hosted MCP server sits on a /v3 path and the changelog calls it legacy (10).

AutoCua 42

Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.

Browser Use 86

OpenAPI 3.1.0 documents for API v2, v3 and v4, the v4 one with 50 operations on 33 paths and 73 schemas on 17 October (25). llms.txt, a full-text bundle and a Markdown copy of every docs page (10). The guides say which product and API version to pick and when not to. In the v4 document four operations have no description, Create Run among them, and request fields such as task, sessionId and maxCostUsd have none. The seven MCP tools have one-line descriptions (13). Required fields are marked and there are 12 enums, but modelParams is free-form and six schemas allow any extra properties, per the 8 October check (10). Python, TypeScript and curl examples throughout, named error schemas for 402, 404 and 429, and a troubleshooting table by status code. 36 of the 50 operations document an error beyond 422, 404 on 32 and 403 on 24, though only three document 429. The 8 October note said most documented only 422, which the 8 October copy of the spec in the vendor's docs repository doesn't bear out either (13). Versioned paths /api/v2, /api/v3 and /api/v4 and a dated public changelog, newest entry 24 August 2026 (15).

AutoCua 38

Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.

Browser Use 69

API keys in a header, several per project, each with an optional monthly spending cap that the docs call a soft limit. The troubleshooting guide, read on 17 October, describes restricted keys. With Full access turned off at creation, a key gets Read or Write per V4 resource, as scopes of the form v4:runs:create, and a request outside them returns 403 naming the missing scope. Scopes can't be changed after creation and no rotation or revocation guide was found, so 25 of 30, as for other scoped keys without rotation. The x402 host authenticates by wallet signature (25). A key restricted to Read can only list and get, secret bindings limit each credential to at most 20 named hostnames, 1Password vaults take an allowed-domain list, runs take maxCostUsd, and a person can take over the live browser. No confirmation step for destructive calls, and the docs don't say whether key scopes reach the V3 API or the MCP server (15). Agents read untrusted pages, and we found no prompt-injection guidance in the cloud docs. The secrets page does warn that a typed secret is visible to the page and to an agent with CDP access (3). Ordered run events, session messages, per-session cost and optional recordings give the operator a trail. No audit log of key or account changes found (12). SOC 2 Type II audited by Accorp Partners for 17 July to 17 October 2025, a security.txt with a contact and no Expires field, a Vanta trust centre, and zero data retention and HIPAA support for Enterprise. No bug bounty or public advisories found (14).

AutoCua 60

Free self-hosted package with nothing to buy: 0 + 20 + 20 + 20 = 60.

Browser Use 90

x402 on x402.api.browser-use.com for the V2 and V3 APIs, in USDC on Base. Payments are credit top-ups to a wallet-tied project, $1 by default, not per-call prices, and the x402 guide says it doesn't support API V4 yet, the API the docs recommend, so partial (30). Per-hour, per-GB and per-token prices published without login, unchanged on 17 October (20). $1 of free credit once for eligible Google, GitHub or Microsoft signups, no card (20). An agent with a funded wallet gets access with no account or API key. The separate agent signup endpoints are off and return 403, per the 8 October check (20).

AutoCua 42

MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.

Browser Use 66

The cloud is closed with published terms, last revised 15 October 2026. The library and the SDK are MIT (20). The privacy policy, which carries no date in the text we read, says 'We use Inputs to train our AI models in order to improve the Services' and keeps data as long as necessary with no periods, re-read on 1 November. The DPA of 30 July 2026 bars use of customer personal data beyond the service, which doesn't sit easily with that. The docs' zero data retention page, last modified 24 October per the docs sitemap, says a project owner can turn it on in Cloud settings with no enterprise contract, covering US session data, with cleanup every 15 minutes, V4 results to be saved within 15 minutes, and no recordings or session history. It doesn't say what model providers keep. The zero data retention page on browser-use.com still says it 'is part of an enterprise agreement' and to email sales, re-read on 1 November. API recording is off by default. With the privacy policy's training sentence and the two zero data retention pages at odds, the statements still don't agree, so 14 stands (14). No deprecation policy found, and the terms, re-read on 1 November, still allow the service to be changed or discontinued with or without notice. The docs mark V2 as legacy and Box, Bux and Skills as retired, without dates (5). The EU page names Frankfurt AWS, Datadog EU and an OpenRouter EU route. The sub-processor list is in a Vanta trust centre we didn't read, and the DPA promises 10 days' notice of new sub-processors (12).

AutoCua 55

Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.

Browser Use 78

The hosted MCP server has seven compact tools. The API has a minimal status endpoint for polling, and run events take limit, an after cursor and include_output (22). Cursor and limit on runs, sessions, files and downloads, and page number and size on browsers, profiles and extensions, so two pagination styles, with status, session and metadata filters (17). Errors carry codes an agent can act on, such as api_key_monthly_spend_limit_reached with cap and spent, rate_limited with limit_rps, and domain_not_allowed with the origin. Other errors are a bare detail string (16). Cancel, session delete and workspace delete are documented as idempotent. POST /runs has no idempotency key, and the docs tell callers to check the earlier run before resubmitting. We didn't read the MCP tools' annotations (8). Only task is required to create a run, with a default model, and official SDKs cover Python and TypeScript (15).