AutoCua vs Lightpanda

AutoCua 25

Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.

Lightpanda 68

Scored as local software, on the open-source browser. Official Docker image (amd64 and arm64), a Homebrew formula and AUR package at 1.0.2, .deb packages, an npm wrapper and a pip package, with supported platforms stated (Linux glibc x86_64 and aarch64, macOS, WSL2 for Windows). The README's Homebrew line, its download links and the install script all default to nightly builds (18 of 20). Public CI runs zig fmt, unit tests and end-to-end tests through a proxy on every push to main, and WPT results are published daily. A clone on 2 November shows the same workflows (zig-test, e2e-test, e2e-integration-test, wpt and others). Whether recent runs passed is unread, because github.com and the GitHub API are unreachable from our network, so the line takes 15, as other listings with an unread pass state (15 of 25). The issue tracker went unread for the same reason. The vendor's 1.0 post lists dozens of use-after-free and double-free fixes, a crash handler reports crashes, and the agent skill tells agents to reinstall the nightly when crashes occur, so we score this line on thin evidence (10 of 25). Semver tags from 0.3.2 to 1.0.2, and the 1.0 post calls out the CORS default change with the flag to undo it. Release notes on GitHub went unread and there is no CHANGELOG file (10 of 15). 1.0.0 on 2 October 2026 is declared out of beta and stable enough for production (15). 18+15+10+10+15 = 68.

AutoCua 42

Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.

Lightpanda 82

Graded on the MCP server at 1.0.2, read from source. Every tool declares a JSON Schema input, and page-changing tools declare an outputSchema for url, httpStatus and title (25). llms.txt indexes 46 docs pages and 31 blog posts, but its docs llms-full.txt link returns 404 and the docs have no Markdown twins (7 of 10). Descriptions state purpose and when to prefer another tool (html "Verbose; use only when you need attributes that markdown discards", evaluate as an escape hatch), and initialize returns a driving guide (18 of 20). Enums for load states, required lists and maxBytes caps, but extract takes its selector spec as a JSON string and evaluate takes arbitrary JavaScript (11 of 15). JSON-RPC request and result examples, extract schema examples and a known-behaviours section, with no error catalogue (11 of 15). Semver tags and release notes linked from the blog, which we couldn't read, no CHANGELOG file, and a docs tool reference that matches 1.0.2 but not main (10 of 15). 25+7+18+11+11+10 = 82.

AutoCua 42

MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.

Lightpanda 65

Graded on the browser. AGPL-3.0, an OSI licence, with a CLA for contributions. Lightpanda Cloud has no terms of service that we could find, so we take 2 off (28 of 30). The privacy policy (3 August 2026) covers the website, the browser's telemetry and crash reports, and the cloud (email, PostHog with the IP address and token ID per session), with cloud data kept while the subscription is active and deleted on unsubscribing. It names both an internal database and PostHog as the telemetry store, doesn't list the tool-call and MCP client events 1.0.2 sends, and says nothing on cloud session content or logs. No DPA (15 of 30). No deprecation policy. The CORS change was announced with a flag to turn it off, experimental options are marked as removable without notice, and security fixes go to main only (5 of 20). Telemetry is on by default and disclosed in the README and the privacy policy with an environment-variable opt-out, but it carries the IP address and a persistent instance ID, and the policy's field list is incomplete for 1.0.2 (10 of 20). 28+15+5+10 = 58.

AutoCua 55

Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.

Lightpanda 75

32 MCP tools at 1.0.2 with no profiles or dynamic loading (5). The CLI fetch and the CDP server reach the same browser with no tool definitions in context, so we add back 5 (10 of 25). markdown, html and screenshot take selector, backendNodeId, maxBytes and strip, links takes limit, tree takes maxDepth, and read tools accept url to navigate and read in one call (20). Errors come back with isError, navigation failures name the cause (navigation failed: CouldntResolveHost), and structuredContent carries httpStatus. The docs warn that a 404 page or a timeout is still reported as success. No list of error codes (14 of 20). Every tool carries readOnlyHint, destructiveHint, idempotentHint and openWorldHint chosen per tool in an exhaustive switch, and nothing needs an idempotency key on a local browser (18 of 20). Most tools need one argument or none, and official packages exist for Node (npm wrapper) and Python (pip). The PyPI page answered a bot check, so the Python package's state went unread (13 of 15). 10+20+14+18+13 = 75.

AutoCua 60

Free self-hosted package with nothing to buy: 0 + 20 + 20 + 20 = 60.

Lightpanda 40

Open-source software with a hosted option, so pricing is scored on Lightpanda Cloud, as browserless's was. No x402, MPP or L402 (0). Plan prices and the $0.08 per browser-hour overage are published without login (20). Explorer is $0 with 10 browser hours a month, and the sign-up form asks only for an email address (20). A person signs up in a browser and receives the token by email (0). 0+20+20+0 = 40.

AutoCua 38

Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.

Lightpanda 46

Graded on the local browser, with the cloud's documented token handling counted. No credential is needed locally, the servers bind 127.0.0.1 by default and serve --unix-socket gives an owner-only socket, but the CDP and HTTP MCP servers have no authentication at all when bound wider, and the MCP docs show --host 0.0.0.0 (18 of 30). Lightpanda Cloud's docs pass the API token as ?token= in the CDP, MCP and mcp-remote URLs as the standard route, a secret in a query string (minus 10). CORS on by default since 1.0, sub-resources off unless asked for, and --block-private-networks, --block-cidrs, --block-urls and adblock lists, all opt-in apart from CORS. No domain allowlist or confirmation step for clicks or form submits (12 of 20). The MCP initialize instructions tell the model to treat page content as untrusted and not to follow URLs a page suggests, and $LP_* placeholders keep credentials out of the model's context. getEnv with a name returns a secret's value (10 of 15). Logs go to stderr with levels that show requests and navigations, and the cloud console lists sessions with logs. No persistent audit log locally (8 of 15). SECURITY.md with a private address, fixes on main only, release binaries with SHA-256 digests checked by the install script and Homebrew, and hardening listed in the 1.0 post. No security.txt, bug bounty, certification or readable advisory list (8 of 20). 18-10+12+10+8+8 = 46.