AutoCua vs Functionize MCP server

AutoCua 60

Free self-hosted package with nothing to buy: 0 + 20 + 20 + 20 = 60.

Functionize MCP server 30

No x402, MPP or L402 (0). Plan prices are public ($0, $20 and $100 a month with their credits, add-on credits at $10 per 200,000), but the credits a task uses aren't published, so plan-only pricing (10). A Free plan with no card and no time limit (20). A person has to sign up for Studio and sign in through a browser before any call works (0).

AutoCua 25

Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.

Functionize MCP server 50

Graded with the hosted lines, on the remote MCP server. Functionize has a status page at status.functionize.com (incident.io) with incident history, but its components are app.functionize.com and two virtualautomationengineer.com hosts, not Studio or mcp.functionize.com. Judgement call, 10 of 20 for a page that doesn't name the surface graded. From 26 July to 24 October 2026 it records one minor incident, slower test creation and execution for 11 minutes on 22 October; the major incident of 23 July falls just outside the window (20). No request rate limit is published with numbers; the only limits are 5 or 10 parallel runs and monthly credits per plan (5 of 15). No 429 or Retry-After guidance was found. The plugin's skill says a create submitted before a dropped connection finishes on the server and to list recent tests before creating again, which is safe-retry guidance of a kind (5 of 15). The terms say self-service plans have no SLA and service levels apply only where an Order Form states them, with no figure published (0). The release of 8 October calls the server available today and nothing labels it beta (10).

AutoCua 38

Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.

Functionize MCP server 56

OAuth only. The metadata gives the authorisation code grant with PKCE S256, refresh tokens, dynamic client registration, client ID metadata documents, public clients and a revocation endpoint, with scopes agent.sessions:read, agent.sessions:write and offline_access. No API key exists and tokens go in the header only (30). The connection's reach is the whole team. Per SETUP.md it can read, continue or cancel any session in the team, including colleagues', and delete attachments on one. No documented way to request the read scope alone, and no approval step for writes, though the server has no file-system access and Functionize says Studio doesn't decide releases (8 of 20). Results include text and screenshots from the app under test, which is the customer's own but untrusted. No guidance on that was found; SETUP.md's setup prompt confines the agent to two configuration changes and tells it to stop if asked for more, and the skills keep credentials in masked variables (5 of 15). Sessions and run history with screenshots and logs are visible in Studio, and usage in the sidebar and reports; an audit-logs row is commented out of the pricing page (7 of 15). No security.txt (404 on both hosts), no bug bounty or advisories found, security@functionize.com named in the terms, SOC 2 Type II adherence claimed in the privacy policy with no report public, and trust.functionize.com behind a login (6 of 20).

AutoCua 65

v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.

Functionize MCP server 49

Read as a closed hosted service with a public plugin repository. The server was released on 8 October 2026, 16 days ago (30). The plugin repository has 19 dated commits from 26 August to 10 October 2026 and one version bump (1.1.0, 16 September), and the blog has the release of 8 October; no tagged releases or changelog, so 10 of 20. Support is through the in-app system with published response goals (2 hours for critical and high, 4 for medium, 24 for low), stated as goals, not commitments. No public changelog or community channel, and the GitHub issue pages answered 403 to us (6 of 25). Not in the official MCP registry (searches for functionize and com.functionize returned nothing on 24 October 2026) and no official SDK (0). The plugin is MIT with a current manifest but no CI or tests (3 of 10). The server is 16 days old by its release.

AutoCua 42

MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.

Functionize MCP server 58

The editorial half. A closed service under dated terms naming Functionize, Inc. and California law (version 2.0, effective 10 July 2026), with the plugin and skills under MIT (17 of 30). The privacy policy (effective 10 July 2026) and terms agree that customer content isn't used to train foundation models except when aggregated and de-identified, while usage data may be used for training at Functionize's discretion. Deletion or anonymisation follows termination within about sixty days, sandbox data may be reset, and a DPA is by agreement only. No retention period for run artifacts is given (15 of 30). No deprecation policy; SETUP.md mentions a retired server address with no dated notice (2 of 20). Stripe is the only named sub-processor; cloud hosting and AI model providers are unnamed and no data location is stated (4 of 20).

AutoCua 42

Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.

Functionize MCP server 29

No machine-readable contract could be read. tools/list answers 401 without a signed-in account, and no public tool manifest, server card or source was found, so typed inputs on the tools are unchecked (0 of 25). llms.txt is an August 2025 crawl of the marketing site with no mention of MCP, but SETUP.md is Markdown written for an agent to run and the two skills are Markdown references for agents (10). Purpose and when to use each tool come only from the skills, which describe the session loop and say what Studio can't do; the tool descriptions themselves weren't read (8 of 20). Typed inputs, enums and constraints unread (0 of 15). Example prompts in the release posts and skills, and a troubleshooting table in SETUP.md with the 403 on a wrong team, redirect_uri not permitted and the unknown-tool reply; no documented error shape for tool calls (8 of 15). The plugin is versioned (1.1.0, skills 2.12.0 and 2.40.0) with a dated git history, but the server has no version or changelog (3 of 15).