AutoCua vs Robocorp

AutoCua 25

Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.

Robocorp 87

Scored as local software. Official PyPI packages with runtimes stated in each pyproject.toml, read from the repositories on 1 November. rpaframework 34.0.0 requires Python 3.11 or later and lists 3.11 to 3.14, robocorp-windows 2.0.0 and robocorp-excel 0.6.0 require 3.11, and the robocorp meta-package 3.1.7 still allows 3.10 (20; the 14 October figures came from PyPI's JSON API, which robots.txt disallows, and are replaced). Public CI per package, with rpaframework's main and Windows workflows passing on master on 4 October 2026 and robocorp's master runs passing to 14 October, per the 14 October check, not re-read on 1 November (25). rpaframework had 35 open issues and pull requests and robocorp 9, and of rpaframework's 15 newest, 8 had no reply, including RPA.Windows and Java Access Bridge problems from 2024, per the 14 October check, not re-read (12 of 25). The README commits to SemVer and each package has a dated changelog. The 1 November batch labels its Python 3.11 floor Breaking and takes a major for it in every rpaframework package and robocorp-windows 2.0.0 (15). rpaframework is marked Production/Stable at 34.0.0 and robocorp is 3.1.7 (15).

AutoCua 42

Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.

Robocorp 65

Graded as a library. Typed Python APIs with docstrings and keyword documentation at rpaframework.org. No machine-readable contract beyond the code (12 of 25). No llms.txt on rpaframework.org (404). The repository's agent skill and its api.md reference are Markdown written for coding agents. sema4.ai docs were unreadable (5 of 10). Keyword docs state purpose with arguments, rarely when not to use one (12 of 20). Type hints and enums on most keywords, some locator strings free-form (10 of 15). Examples throughout, and typed exceptions such as ElementNotFound (11 of 15). Dated changelogs per package and SemVer (15).

AutoCua 42

MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.

Robocorp 65

Apache-2.0 for both repositories (30). The libraries run locally. Sema4.ai's privacy policy and terms were behind a bot check, and rpaframework.org loads Google Analytics (8 of 30). Changelogs record removals and deprecations, with no deprecation policy found (10 of 20). No telemetry code in the libraries. rcc has a do-not-track setting whose default was not read (8 of 20).

AutoCua 65

v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.

Robocorp 81

rpaframework 34.0.0 and eleven other rpaframework packages tagged on 1 November 2026, with the RPA.Windows Control Parent Window keyword, a work item pagination fix and the new rpaframework-decision package, and a release workflow that publishes from tags. PyPI couldn't be read from the shell (30). In the 90 days from 3 August, rpaframework 33.0.0 to 33.0.2 and 34.0.0 and robocorp 3.1.3 to 3.1.7, robocorp-log 3.1.4 to 3.1.7, robocorp-vault 1.4.1 and 1.4.2 and robocorp-windows 1.1.3 and 2.0.0 (20). Commits are frequent, 21 in rpaframework and 26 in robocorp since 3 August, but most new issues got no reply, per the 14 October check (12 of 25). Current official packages, no MCP server (10 of 15). Lockfiles, scheduled dependency checks and CI workflows, run state per the 14 October check (9 of 10).

AutoCua 38

Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.

Robocorp 44

Graded as a library. No credential of its own. robocorp.vault reads secrets from Control Room or a local file, and robocorp.log hides sensitive names and values (18 of 30). No least-privilege mode or approval step, and robots run with the user's desktop rights (5 of 20). Desktop and browser content is read back into tasks with no injection guidance found (4 of 15). robocorp.log writes a detailed log of each run with every call and its arguments, minus hidden values (11 of 15). No SECURITY.md in either repository and no advisories against rpaframework, robocorp or robocorp-windows in OSV on 1 November. Released dependency updates for third-party advisories on 4 and 8 October, 18 October (pillow, cryptography, dompurify) and 1 November (pillow 13, certifi, pypdf and others), and CodeQL in rpaframework's workflows. Sema4.ai's security pages still answer with a bot check (6 of 20).