# AutoCua vs Puppeteer (slim)

> Puppeteer scores 70.7 (BB) to AutoCua's 44.3 (E) for browser automation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/autocua-vs-puppeteer.md (~4,400 tokens) · this version ~2,230 tokens · JSON https://www.anchorterminal.com/compare/autocua-vs-puppeteer.json · canonical https://www.anchorterminal.com/compare/autocua-vs-puppeteer
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-06
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Puppeteer scores 70.7 (BB) on agent readiness against AutoCua's 44.3 (E), and leads in 6 of 7 scored categories. Both do browser automation.

- AutoCua: E 44.3, rank #1100 of 1354 · https://www.anchorterminal.com/tools/autocua.min.md
- Puppeteer: BB 70.7, rank #172 of 1354 · https://www.anchorterminal.com/tools/puppeteer.min.md
- AutoCua, good for Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control.
- Puppeteer, good for Agents that write and run Node.js scripts against Chrome or Firefox. Ahead on Reliability, 80 against 25; Schema & documentation, 81 against 42; Agent ergonomics, 67 against 55; Security & auth, 52 against 38; Maintenance & community, 89 against 65; Transparency & trust, 71 against 42. Also Agent-ready, a grade of BB or better.

| Category | AutoCua | Puppeteer |
| --- | --- | --- |
| Reliability (16%) | 25 | 80 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 42 | 81 |
| Agent ergonomics (13%) | 55 | 67 |
| Security & auth (14%) | 38 | 52 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 65 | 89 |
| Transparency & trust (7%) | 42 | 71 |

| Fact (where they differ) | AutoCua | Puppeteer |
| --- | --- | --- |
| Kind | Agent framework | SDK + MCP |
| Vendor | Ashish Yadav and contributors (ComputerUseAgent on GitHub) | Google |
| Licence | MIT | Apache-2.0 |
| Last release | 2026-11-04 | 2026-10-22 |
| Popularity | none | 96k stars, 11.5M npm/wk |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Reliability, Puppeteer +55: AutoCua 25 (Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.); Puppeteer 80 (Scored as local software. Official npm packages `puppeteer` and `puppeteer-core` at 25.16.0 (repository tag, 22 October 2026), with Node.js 22.12 or later stated in `engines` and a browser support table (20). Public CI runs Chrome and Firefox tests on Linux, macOS and Windows. Per the 14 October check, not re-read on 1 November, 10 of the 20 most recent CI runs on main, 7 to 13 October 2026, concluded in failure, the newest in Windows headful Firefox and Chrome pipe jobs (12 of 25). Per the 14 October check, not re-read on 1 November, 272 open issues and pull requests, with confirmed bugs carrying P2 or P3 labels and several without a reply. One of them, `page.goto()` ignoring its timeout after a second navigation, was fixed in 25.16.0 (18 of 25). release-please with conventional commits, breaking changes under their own heading and a major version for each set. None of the six releases since 25.13.0 marks a breaking change (15). Version 25, stable (15).)
- Schema & documentation, Puppeteer +39: AutoCua 42 (Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.); Puppeteer 81 (Graded as a library. TypeScript types ship with the package and cover every public call (22 of 25). No llms.txt (404 on 1 November) and no Markdown routes on pptr.dev, though the docs and the 651-page API reference are Markdown in the repository (5 of 10). TSDoc on each member with remarks and parameter descriptions. Guides explain when to use locators or `page.$()`, with few statements of when not to use a call (14 of 20). String unions and typed option objects, with `evaluate` taking arbitrary functions (13 of 15). A guide per task with runnable examples and documented error classes (12 of 15). Versioned releases and a changelog for each (15).)
- Transparency & trust, Puppeteer +29: AutoCua 42 (MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.); Puppeteer 71 (Apache-2.0, published by Google (30). No data statement for the library. It runs locally, downloads browsers from Google's storage at install, and the docs say where browsers are cached (18 of 30). Each release lists breaking changes, deprecated APIs are marked in the reference, and the support table maps versions to browsers. No written deprecation policy (10 of 20). No telemetry found in the library source, and the docs do not say so either way (14 of 20).)
- Maintenance & community, Puppeteer +24: AutoCua 65 (v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.); Puppeteer 89 (25.16.0 on 22 October 2026 (30). Twelve releases in the 90 days from 3 August, 25.5.0 on 4 August to 25.16.0 (20). Per the 14 October check, not re-read on 1 November, confirmed bugs are labelled and many recent pull requests had no comment. Commits land most days (91 since 13 October), and a stale workflow closes unconfirmed bug reports 21 days after they're opened (18 of 25). Current official npm packages, no MCP server to register (15). Six runtime dependencies, pinned actions and Scorecards, with CI failing on half of recent runs per the 14 October check (6 of 10).)
- Security & auth, Puppeteer +14: AutoCua 38 (Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.); Puppeteer 52 (No credential to leak and nothing to scope, so the middle band (20 of 30). Chrome's sandbox stays on unless the script turns it off. Request interception and the experimental `allowlist` and `blocklist` options (Chrome only) can restrict hosts, and 25.15.0 added `browser.restrictNetwork()` to change them at run time. Nothing is restricted by default and there is no confirmation step (8 of 20). Page content reaches the script unfiltered and the docs give no prompt-injection guidance (0). Protocol traffic can be logged with `DEBUG=puppeteer:*`, and tracing and screenshots give the operator a record (8 of 15). SECURITY.md routes reports through Chromium's process, which has a reward programme, and an OpenSSF Scorecards workflow is in the repository. OSV lists one advisory, a 2020 use-after-free fixed in 1.13.0, and none since (16 of 20).)
- Agent ergonomics, Puppeteer +12: AutoCua 55 (Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.); Puppeteer 67 (A library adds no tool definitions to context. `page.accessibility.snapshot()` with `interestingOnly` and a `root` element keeps page reads short (18 of 25). Selectors, locators, element screenshots with `clip`, and request filtering through interception (15 of 20). Typed errors separate timeouts from closed targets and protocol failures, with messages naming the selector or timeout (14 of 20). Locators wait for visibility and stability and retry actions. No annotations or idempotency concept apply (10 of 20). `launch()` works with defaults and a bundled browser. JavaScript and TypeScript only (10 of 15).)