# AutoCua vs Skyvern (slim)

> Skyvern scores 57.5 (C) to AutoCua's 44.3 (E) for browser automation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/autocua-vs-skyvern.md (~5,450 tokens) · this version ~3,280 tokens · JSON https://www.anchorterminal.com/compare/autocua-vs-skyvern.json · canonical https://www.anchorterminal.com/compare/autocua-vs-skyvern
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-06
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Skyvern scores 57.5 (C) on agent readiness against AutoCua's 44.3 (E), and leads in 6 of 7 scored categories. AutoCua leads on payments & pricing. Both do browser automation.

- AutoCua: E 44.3, rank #1100 of 1354 · https://www.anchorterminal.com/tools/autocua.min.md
- Skyvern: C 57.5, rank #709 of 1354 · https://www.anchorterminal.com/tools/skyvern.min.md
- AutoCua, good for Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control. Ahead on Payments & pricing, 60 against 16. Also No key needed to call it; No incidents deducted, where Skyvern loses 9 points for them.
- Skyvern, good for Agents that must finish a multi-step job on sites with logins, 2FA and forms, where stored credentials, saved workflows and cached scripts matter more than raw browser time. Ahead on Reliability, 67 against 25; Schema & documentation, 88 against 42; Agent ergonomics, 76 against 55; Security & auth, 59 against 38; Maintenance & community, 85 against 65; Transparency & trust, 76 against 42. Also A hosted endpoint, with nothing to install; Runs on your own machine.

| Category | AutoCua | Skyvern |
| --- | --- | --- |
| Reliability (16%) | 25 | 67 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 42 | 88 |
| Agent ergonomics (13%) | 55 | 76 |
| Security & auth (14%) | 38 | 59 |
| Payments & pricing (10%) | 60 | 16 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 65 | 85 |
| Transparency & trust (7%) | 42 | 76 |

| Fact (where they differ) | AutoCua | Skyvern |
| --- | --- | --- |
| Kind | Agent framework | HTTP API |
| Vendor | Ashish Yadav and contributors (ComputerUseAgent on GitHub) | Ikonomos Inc. (Skyvern) |
| Hosted endpoint | no (local only) | `https://api.skyvern.com/v1` |
| Transports |  | HTTP, Streamable HTTP, stdio |
| Auth | None | OAuth or key |
| Pricing | Free | Paid |
| Licence | MIT | AGPL-3.0 for the open-source server, SDKs and MCP server. Skyvern Cloud is a proprietary service under Skyvern's terms, and its anti-bot measures aren't in the repository |
| Tools exposed | none | 118 |
| llms.txt | no | yes |
| MCP registry | not listed | `io.github.Skyvern-AI/skyvern` |
| Last release | 2026-11-04 | 2026-10-14 |
| Terms last updated | no document linked | 2026-02-27 |
| Privacy policy last updated | no document linked | 2026-10-01 |
| Customer content may train models | not read yet | yes, with an opt-out |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | none | 23k stars, 3.2k npm/wk, 1.6k PyPI/wk |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Schema & documentation, Skyvern +46: AutoCua 42 (Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.); Skyvern 88 (OpenAPI 3.1.0 at /docs/api-reference/openapi.json, now 106 operations on 80 paths with 279 schemas, and MCP tools with typed parameters (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). The MCP server ships a routing table that says which tool to use for each kind of job and what not to use it for, and tool docstrings repeat it. Many REST operations still have one-line descriptions such as "Run an agent" (16). Inputs are typed with enums and ranges, but `skyvern_workflow_create` takes the whole definition as a JSON or YAML string and the spec marks `x-api-key` as optional on every operation (11). Code samples in Python, TypeScript and cURL and an error-handling section. 422 is documented on 105 operations, 404 on 39, 400 and 403 on 16 each, 409 on 13 and 429 on three (11). `/v1` path versioning with a written compatibility policy and a weekly dated changelog (15). 25 + 10 + 16 + 11 + 11 + 15 = 88.)
- Payments & pricing, AutoCua +44: AutoCua 60 (Free self-hosted package with nothing to buy: 0 + 20 + 20 + 20 = 60.); Skyvern 16 (No x402, MPP or L402 in the docs, llms.txt or pricing page (0). The billing docs now publish unit prices, one credit $0.001, an action 30 credits ($0.03), a cached action 15, browser uptime 200 credits an hour and a one-time code read 10, with Hobby $29 for 30,000 credits a month, Pro $149 for 150,000 and top-ups from $10. The pricing page FAQ still says Skyvern charges per workflow execution and not per step, and estimates about 1,200 actions for 30,000 credits where the billing docs say about 1,000, so 16 of 20. The free plan has gone. Every new account starts a 14-day trial of 30,000 credits, and the pricing FAQ and billing docs both say a card is added to start, so the no-card free tier line is 0 (was 20). Signup is a browser flow, including `skyvern signup` from the CLI, so a person has to create the account (0). The open-source server is free to run under AGPL-3.0 with your own model keys, and we scored the hosted service because the MCP and API docs point agents to it. 0 + 16 + 0 + 0 = 16.)
- Reliability, Skyvern +42: AutoCua 25 (Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.); Skyvern 67 (Graded as a hosted service, Skyvern Cloud at api.skyvern.com. status.skyvern.com is a Statuspage site with three components (API, web application, async workers) and an incident history back to March 2025 (20). Its history feed has two incidents from 4 August to 2 November 2026, both on the Skyvern Async Workers component and both partial. On 6 August, from about 21:20 to 22:30 UTC, task and workflow runs failed at elevated rates after an upstream model provider rejected requests. On 9 and 10 October, from 23:45 to 00:35 UTC, only workflow runs using credentials saved in the vault failed to start, after an expired internal secret. Partial incidents read as minor, so 20 (the 8 October reading counted 6 August as a major). The 3 July 503 run is outside the window. Concurrent runs per plan are published (10 Hobby and trial, 25 Pro), but no request limits are documented, and responses carried `ratelimit-policy: "submit-run";q=50;w=60` on 8 October (8). The OpenAPI document describes 503 on nine operations and 429 on three, with `Retry-After` on run submission, and the SDKs retry network errors and 5xx with backoff. `Idempotency-Key` exists only on POST /v1/agents (9). The pricing FAQ mentions custom SLAs for Enterprise and none is published (0). `/v1` is declared stable (10). 20 + 20 + 8 + 9 + 0 + 10 = 67.)
- Transparency & trust, Skyvern +34: AutoCua 42 (MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.); Skyvern 76 (The core is AGPL-3.0, an OSI licence, in a public repository. The README says anti-bot measures are in the managed cloud only (27). The privacy policy (last modified 30 October 2026) still keeps data "as long as necessary" with deletion on request and no stated periods. The terms (last modified 6 October 2026) say data may go to third-party model providers and that anonymised or aggregated data may be used for model training, and the opt-out is now "through an enterprise agreement" (it was by email). Section 7.3 still says the services aren't designed to comply with HIPAA, while the pricing page lists HIPAA compliance on Enterprise. No public DPA found (12). The deprecation policy promises at least six months' notice, 12 for a major version, a changelog entry, `Deprecation` and `Sunset` headers and `deprecated` flags in the spec (20). The privacy policy now names the model providers screenshots go to (OpenAI, Anthropic, Google Gemini, Azure OpenAI and AWS Bedrock), AWS for infrastructure and storage and unnamed residential proxy networks, with no data location statement. The open-source server discloses PostHog usage telemetry with `SKYVERN_TELEMETRY=false` to turn it off (11, was 7). 27 + 12 + 20 + 11 = 70.)
- Agent ergonomics, Skyvern +21: AutoCua 55 (Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.); Skyvern 76 (The full MCP surface is 118 tools by the docs' count (5). Scopes cut that to 31 (`operate`), 34 (`lean`), 55 (`browser`) or 63 (`build`) through a URL such as /mcp/x/lean or the `X-Skyvern-Scope` header, and page reads are size-capped and selector-scoped (9, so 14). List endpoints take `page` and `page_size`, with `status`, `search_key`, tag and date filters, the task list added optional cursor pagination in the week of 12 October, and `max_steps` bounds a run (17). MCP results return codes such as SELECTOR_NOT_FOUND and SESSION_EXPIRED with a hint, runs report `status`, `failure_reason` and a caller-defined `error_code_mapping`, and the SDKs raise typed errors. HTTP error bodies are mostly unspecified (16). Every tool has readOnlyHint, destructiveHint and openWorldHint annotations, 118 registrations in the source on 2 November. `Idempotency-Key` covers agent creation only, not run submission (14). A task needs only a prompt, and official SDKs exist for Python and TypeScript (15). 14 + 17 + 16 + 14 + 15 = 76.)
- Security & auth, Skyvern +21: AutoCua 38 (Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.); Skyvern 59 (An organisation-wide API key in the `x-api-key` header, rotated from Settings, with additional organisation keys an Admin can create, revoke or reissue in the app, or OAuth 2.0 with PKCE, dynamic client registration and rotating single-use refresh tokens. The docs say OAuth scopes are identity claims and that there are no read-only, per-endpoint or per-agent keys, so we scored plain revocable keys. No secret travels in a URL (20). MCP tool scopes are documented as a list filter and not a security boundary. Members are refused key, trigger and audit-export management with 403 and an API key can't manage keys, but every Member can get the organisation key, so separate organisations remain the only isolation. Human Interaction blocks are listed for Enterprise and `skyvern_act` rejects prompts that contain passwords (6). Web pages are untrusted content. Stored credentials reach the browser directly and appear to the model as placeholders, the May 2026 changelog records sanitising of page content in prompt templates, and one tool description says page content is data, not instructions. We found no guidance page on prompt injection (8). GET /v1/audit-events/export returns organisation audit events for a default 90 days as JSON or CSV, and each run keeps a recording, screenshots, an action timeline and a HAR file (14). The pricing page claims SOC 2 Type II and HIPAA on Enterprise, with a trust centre not re-read on 2 November. SECURITY.md routes reports to GitHub private advisories and its supported-versions table still says 0.1.x. No security.txt (404 on 2 November) and no bug bounty found. OSV holds one advisory, CVE-2025-49619 of June 2025 (11). 20 + 6 + 8 + 14 + 11 = 59.)