{ "data": { "a": { "slug": "autocua", "name": "AutoCua", "vendor": "Ashish Yadav and contributors (ComputerUseAgent on GitHub)", "vendorUrl": "https://github.com/ComputerUseAgent/AutoCua", "kind": "framework", "category": "desktop-automation", "summary": "AutoCua is an open-source Python agent that operates a computer the way a person does, desktop apps, a terminal, your own Chrome and iOS or Android phones, with any of 60 models from ten providers.", "url": "https://www.anchorterminal.com/tools/autocua", "markdownUrl": "https://www.anchorterminal.com/tools/autocua.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/autocua.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/autocua.json", "dns": "autocua.grade.anchorterminal.com", "repo": "https://github.com/ComputerUseAgent/AutoCua", "license": "MIT", "transports": [], "packages": [ { "registry": "pypi", "name": "AutoCua" } ], "auth": "none", "authNotes": "No account. You bring an API key for the model provider you choose, kept with chats, Chrome profiles and a credential vault in a local AutoCua_data folder.", "pricing": "free", "pricingNotes": "Free and MIT-licensed. You pay your model provider for tokens. Nothing to buy from the project (checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "A local package with nothing to buy and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/ComputerUseAgent/AutoCua#readme", "capabilities": [ "browser.control", "agent.run" ], "tags": [ "open-source", "mit", "python", "computer-use", "local", "new" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 44.3, "grade": "E", "agentReady": false, "rank": 1100, "ranked": true, "rankOf": 1354, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 55, "maintenance": 65, "payments": 60, "reliability": 25, "schema": 42, "security": 38, "transparency": 42 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "A capable, fast-moving open-source agent for driving desktops, browsers and phones through real input and accessibility trees, with a careful safety section. It's two weeks old, with no test CI or changelog, and on Windows the model itself decides whether to accept an admin elevation prompt.", "bestFor": "Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control.", "strengths": [ "One run_agent call drives the desktop, a terminal, your Chrome, or an iOS or Android device", "Element picking from accessibility trees and OCR instead of pixel coordinates", "Credentials typed from a vault so the model never sees them, in the browser and phone agents", "No telemetry, and nothing downloaded without a yes on the terminal", "MIT licence, a pip wheel per OS and architecture, and 60 models across ten providers" ], "weaknesses": [ "Two weeks old at version 0.1.9, with no changelog file", "No CI running the tests; the only workflow labels issues", "On Windows the model answers UAC elevation prompts itself through a kernel input driver", "Keeps API keys and logged-in Chrome profiles in a local folder next to the checkout", "No API reference beyond the README" ], "agentNotes": [ "pip install AutoCua, then call run_agent with a mode such as \"web use\" or \"computer use\", a provider, a model and a task", "Run it on a machine or account you can afford to lose; it drives real input and keeps logged-in browser profiles", "On Windows, don't install the Interception driver unless you accept the model deciding UAC prompts", "Set AutoCua_DATA_DIR to keep keys and profiles somewhere private", "Phones go over USB from a script; Wi-Fi only through the desktop app" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 44.3 } ], "editorialScores": { "ergonomics": 55, "maintenance": 65, "payments": 60, "reliability": 25, "schema": 42, "security": 38, "transparency": 70 }, "provenanceScore": 13, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install AutoCua\n# then, in Python:\n# from AutoCua.agent_launcher import run_agent\n# run_agent(mode=\"web use\", provider=\"openrouter\", model=\"gemini-3.8-flash\", task=\"Open wikipedia.org and summarise today's featured article.\")" }, "letme": { "capability": "https://letme.dev/browser.control", "tool": "https://letme.dev/autocua" }, "area": "developer", "provenance": { "legalEntity": "", "domain": "github.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The licence names Ashish Yadav as copyright holder; most commits are from the GitHub user FunctionFreak. No company, site or terms were found.", "github.com/AutoCua/AutoCua and github.com/ComputerUseAgent/AutoCua serve the same main branch, so one is a rename or mirror of the other." ], "score": 13 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/autocua.json" }, "answer": "Steel scores 71.5 (BB) on agent readiness against AutoCua's 44.3 (E), and leads in every scored category.", "b": { "slug": "steel", "name": "Steel", "vendor": "Nen Labs, Inc.", "vendorUrl": "https://steel.dev", "kind": "http-api", "category": "browser", "summary": "Steel runs cloud browser sessions for AI agents, controlled through a REST API, a CDP WebSocket, SDKs, a CLI and an official MCP server. Its browser runtime, steel-browser, is open source and can be self-hosted.", "url": "https://www.anchorterminal.com/tools/steel", "markdownUrl": "https://www.anchorterminal.com/tools/steel.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/steel.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/steel.json", "dns": "steel.grade.anchorterminal.com", "repo": "https://github.com/steel-dev/steel-browser", "license": "Proprietary cloud service under Steel's terms. steel-browser and the Node and Python SDKs are Apache-2.0. The MCP server and the CLI are MIT", "transports": [ "http", "stdio" ], "remoteUrl": "https://api.steel.dev", "packages": [ { "registry": "npm", "name": "steel-sdk" }, { "registry": "pypi", "name": "steel-sdk" }, { "registry": "npm", "name": "@steel-dev/cli" } ], "auth": "api-key", "authNotes": "Self-serve API key from the dashboard at app.steel.dev, sent in the `steel-api-key` header. Keys are named, shown once and revoked by deletion, and the dashboard shows when each was last used. A global key covers the whole organisation, and `POST /v1/api-keys` lets a global key create keys bound to one project. No per-permission scopes were found. CDP connections pass the key as the `apiKey` query parameter on `wss://connect.steel.dev`. The x402 endpoints need no key. A self-hosted steel-browser needs no key.", "pricing": "freemium", "pricingNotes": "Launch is $0 plus usage with $30 of one-time credit valid for 90 days, and the quickstart says no card is required. Browser time is $0.10 an hour on Launch and $0.08 on Scale ($250 a month with $100 of monthly credit), billed by the minute and rounded up. Proxy traffic is $10 or $6 a GB, CAPTCHA solves $3 or $1 per 1,000, and scrape, screenshot and PDF calls $5 per 1,000. CAPTCHA solving and managed proxies on Launch need $10 of paid balance. The same three calls cost $0.01 each by x402. Enterprise is priced through sales. Self-hosted steel-browser is free (https://docs.steel.dev/overview/pricinglimits, checked 2026-10-08).", "priceSummary": "$0.01 / call", "where": "both", "x402": { "level": "yes", "evidence": "x402 version 2 on https://x402.steel.dev for scrape, screenshot and PDF at $0.01 a call in USDC on Base or Solana, with no account or API key (https://docs.steel.dev/integrations/x402). An unpaid POST to /v1/scrape on 2026-10-08 returned 402 with a payment-required header for 10000 base units on eip155:8453 and Solana mainnet. The header names https://api.paysponge.com/v1/scrape as the resource, so a third party appears to run the payment layer. Browser sessions and api.steel.dev aren't covered.", "endpoints": [ { "url": "https://x402.steel.dev/v1/scrape", "priceUsd": 0.01, "network": "eip155:8453" }, { "url": "https://x402.steel.dev/v1/screenshot", "priceUsd": 0.01, "network": "eip155:8453" }, { "url": "https://x402.steel.dev/v1/pdf", "priceUsd": 0.01, "network": "eip155:8453" } ] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 46988, "pypiWeekly": 63315, "asOf": "2026-10-08" }, "docsUrl": "https://docs.steel.dev", "llmsTxt": "https://docs.steel.dev/llms.txt", "openapi": "https://docs.steel.dev/openapi.json", "capabilities": [ "browser.control", "browser.hosted", "browser.debug", "web.scrape", "web.fetch", "scraping.proxies", "scraping.anti-bot", "pdf.generate" ], "tags": [ "official", "hosted", "self-hosted", "open-source", "freemium", "no-card", "x402", "openapi", "llms-txt", "mcp", "python", "typescript", "proxies", "status-page" ], "lastRelease": "2026-10-31", "graded": true, "anchor": { "graded": true, "score": 71.5, "grade": "BB", "agentReady": true, "rank": 140, "ranked": true, "rankOf": 1354, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 82, "payments": 75, "reliability": 63, "schema": 86, "security": 56, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "The hosted API has a public OpenAPI document, per-unit prices, $30 of starting credit and x402 payment for scrape, screenshot and PDF calls. Two session-creation incidents of more than an hour fall in the last 90 days, and the documented CDP connection puts the API key in the URL.", "bestFor": "Agents that need a real cloud browser with persistent profiles, stored logins, CAPTCHA solving and a human takeover path, and teams that want an open-source runtime they can also self-host.", "strengths": [ "OpenAPI 3.0.3 document with 75 operations, llms.txt and a Markdown twin of every docs page", "x402 at x402.steel.dev for scrape, screenshot and PDF at $0.01 a call in USDC on Base or Solana, with no account", "Per-unit prices published without login, and $30 of one-time credit on the Launch plan", "Official MCP server with 16 annotated tools, a three-tool scrape profile and page content fenced as untrusted", "steel-browser, the browser runtime, is Apache-2.0 and self-hostable with Docker" ], "weaknesses": [ "Two incidents of more than an hour hit session creation in the 90 days to 1 November 2026 (23 August, 1 October), per the status history read on 8 October", "The documented CDP connection passes the API key as `apiKey` in the `wss://connect.steel.dev` URL", "x402 covers the three one-shot endpoints only, so a browser session needs an account and a key", "The MCP server is not on npm or in the MCP registry, and `mcp.steel.dev` is not live per its README", "No deprecation policy or security.txt found, and the trust centre did not render for our reader" ], "agentNotes": [ "Use `POST /v1/scrape` for pages you only need to read. It starts no session and costs $5 per 1,000 calls, or $0.01 a call by x402", "Release every session with `POST /v1/sessions/{id}/release` and set `inactivityTimeout`. Browser time bills by the minute, rounded up", "Build the CDP URL as `wss://connect.steel.dev?apiKey=\u003ckey\u003e\u0026sessionId=\u003cid\u003e` and keep it out of logs, because it carries the key", "Launch sessions end after 15 minutes at most, and `timeout` cannot be changed on a live session", "CAPTCHA solving and Steel's managed proxies on Launch need $10 of paid balance. Free credit does not count" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.5 } ], "editorialScores": { "ergonomics": 79, "maintenance": 82, "payments": 75, "reliability": 63, "schema": 86, "security": 56, "transparency": 52 }, "provenanceScore": 78, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install steel-sdk", "http": "curl -X POST https://api.steel.dev/v1/scrape -H \"steel-api-key: YOUR_KEY\" -H \"Content-Type: application/json\" -d '{\"url\": \"https://example.com\"}'", "claudeCode": "claude mcp add steel -e STEEL_API_KEY=your-steel-api-key -- npx -y github:steel-dev/steel-mcp-server", "config": { "mcpServers": { "steel": { "args": [ "-y", "github:steel-dev/steel-mcp-server" ], "command": "npx", "env": { "STEEL_API_KEY": "\u003cyour-steel-api-key\u003e" } } } }, "x402": "curl -i -X POST https://x402.steel.dev/v1/scrape -H \"Content-Type: application/json\" -d '{\"url\": \"https://example.com\", \"format\": [\"markdown\"]}'" }, "letme": { "capability": "https://letme.dev/browser.control", "tool": "https://letme.dev/steel" }, "area": "developer", "unitPrices": [ { "item": "Browser, Launch plan", "unit": "browser-hour", "usd": 0.1, "note": "Billed by the minute, rounded up" }, { "item": "Browser, Scale plan", "unit": "browser-hour", "usd": 0.08 }, { "item": "Proxy traffic, Launch", "unit": "gb", "usd": 10 }, { "item": "Proxy traffic, Scale", "unit": "gb", "usd": 6 }, { "item": "Scrape, screenshot or PDF", "unit": "1k-requests", "usd": 5 }, { "item": "Scrape, screenshot or PDF by x402", "unit": "call", "usd": 0.01, "note": "USDC on Base or Solana, no account" }, { "item": "CAPTCHA solves, Launch", "unit": "1k-requests", "usd": 3 }, { "item": "CAPTCHA solves, Scale", "unit": "1k-requests", "usd": 1 }, { "item": "Scale plan", "unit": "month", "usd": 250, "note": "$100 of usage credit each month" }, { "item": "Dedicated IP, Scale", "unit": "month", "usd": 5, "note": "Per IP" } ], "provenance": { "legalEntity": "Nen Labs, Inc.", "domain": "steel.dev", "domainRegistered": "2024-07-22", "endpointOnVendorDomain": true, "terms": "https://steel.dev/terms", "privacy": "https://steel.dev/privacy", "statusPage": "https://status.steel.dev", "changelog": "https://docs.steel.dev/changelog", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The terms (last updated 5 February 2025) and the privacy notice (last updated 9 October 2026) name Nen Labs, Inc., 9450 SW Gemini Dr, PMB 34667, Beaverton, OR 97008, United States, and the terms choose Delaware law.", "The docs Legal page links to Google Docs copies of the terms and privacy policy and not to steel.dev/terms and steel.dev/privacy. We read the steel.dev pages.", "The API answers at api.steel.dev, CDP at connect.steel.dev and x402 at x402.steel.dev. The x402 payment header names api.paysponge.com as the resource.", "steel.dev/.well-known/security.txt and docs.steel.dev/.well-known/security.txt both return 404. The site footer's Security link goes to a Vanta trust centre at trust.steel.dev.", "RDAP for steel.dev gives a registration date of 2024-07-22.", "Changelog entries are numbered and carry dates in page metadata. Number 038 is dated 2 October 2026.", "status.steel.dev's robots.txt disallows every path on 1 November 2026, so the status page's history wasn't re-read.", "steel.dev/.well-known/security.txt still returns 404 on 1 November 2026." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/steel.json", "live": { "slug": "steel", "probe": { "target": "https://api.steel.dev", "method": "get", "lastAt": "2026-11-06T09:47:51.721211014Z", "lastOk": true, "lastStatus": 200, "lastMs": 403, "authRequired": false, "uptime24h": 99.55, "uptime30d": 99.94, "p50ms24h": 433, "p95ms24h": 537, "samples24h": 221, "samples30d": 7137, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 247 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 252 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 184 }, { "date": "2026-11-06", "probes": 102, "ok": 102 } ] }, "vendorStatus": { "page": "https://status.steel.dev", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-06T05:42:40.612238821Z" }, "versions": [ { "registry": "github", "name": "steel-dev/steel-browser", "version": "v0.5.5-beta", "released": "2026-10-31", "seenAt": "2026-11-05T22:10:53.003865284Z" }, { "registry": "npm", "name": "@steel-dev/cli", "version": "0.3.1", "seenAt": "2026-11-05T22:10:51.805227428Z" }, { "registry": "npm", "name": "steel-sdk", "version": "0.18.0", "seenAt": "2026-11-05T22:10:50.788817486Z" }, { "registry": "pypi", "name": "steel-sdk", "version": "0.19.0", "released": "2026-06-23", "seenAt": "2026-11-05T22:10:51.595590909Z" } ], "githubStars": 7928, "npmWeekly": 120550, "pypiWeekly": 52927, "securityTxt": { "url": "https://steel.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-05T15:56:46.6288451Z" }, "llmsTxt": { "url": "https://docs.steel.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-05T15:27:23.469025113Z" }, "domain": { "domain": "steel.dev", "registered": "2024-07-22", "source": "https://pubapi.registry.google/rdap/domain/steel.dev", "checkedAt": "2026-11-01T14:10:38.805493981Z" }, "pages": [ { "url": "https://docs.steel.dev/changelog", "kind": "changelog", "status": 404, "checkedAt": "2026-11-05T12:53:57.685503298Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://docs.steel.dev/overview/pricinglimits", "kind": "pricing", "status": 304, "checkedAt": "2026-11-05T12:53:59.727122109Z", "changedAt": "2026-11-05T12:31:56.964370055Z", "fingerprint": "f110817a6163" }, { "url": "https://steel.dev/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-05T13:05:20.659368223Z", "changedAt": "2026-10-24T02:26:15.455933336Z", "fingerprint": "c8c1e9e2f75c" }, { "url": "https://steel.dev/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-05T13:05:23.594202206Z", "changedAt": "2026-10-24T02:26:17.767199086Z", "fingerprint": "ea2f7ef61410" } ], "github": { "repo": "steel-dev/steel-browser", "checkedAt": "2026-11-02T09:28:10.141805179Z", "stars": 7904, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T22:53:20Z", "openIssues": 40, "openPRs": 40, "issuesOpened90d": 16, "issuesClosed90d": 6, "prsMerged90d": 34, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-10-31T22:53:26Z" }, "replies": { "sampled": 25, "unanswered": 20, "medianDays": 1.7 } }, "updatedAt": "2026-11-06T09:47:51.721211014Z" } }, "edges": [ { "by": 44, "category": "schema", "leads": "steel", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.", "b": "OpenAPI 3.0.3 at docs.steel.dev/openapi.json with 51 paths and 75 operations and the `steel-api-key` header scheme (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). 65 of 75 operations carry a description, and the MCP server's tool descriptions say when to use each tool and when to pick another (16). Inputs are typed with enums, UUID formats and list limits of 1 to 100, but `timeout` and `concurrency` carry no real bounds and `useProxy` and `region` have no stated type (11). One shared error schema is attached to most operations and the docs have error tables for Browser Tools and Agent Traces. The spec holds one example, and 429 is declared on session creation only (11). Paths are versioned under /v1 and the changelog is public and numbered, with dates in page metadata. The spec's own version reads 0.0.1 (13)." }, "scores": { "a": 42, "b": 86 } }, { "by": 38, "category": "reliability", "leads": "steel", "name": "Reliability", "reasons": { "a": "Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.", "b": "Graded as a hosted service, on Steel Cloud. status.steel.dev runs on Better Stack with Steel API, Dashboard, Proxies and Connections components and 90 days of history, per the 8 October check (20). On 1 November its robots.txt disallows every path, so the history wasn't re-read. Per the 8 October check, the 4 hour 10 minute outage of 22 July 2026 has now left the 90-day window, leaving two majors in it, 5 hours 41 minutes of capacity errors on session creation on 23 August and 1 hour 55 minutes of failing session creation on 1 October. Two majors give 5, and anything posted after 8 October is unread, which would also score 5 as no readable history (5). Limits are published per plan, 60 and 600 requests a minute and 10 and 100 concurrent sessions, re-read on 1 November, and 20 a minute on Browser Tools (15). Browser Tools document 429 and a 503 marked safe to retry, the Agent Traces API says to wait for `Retry-After`, and the SDKs retry 408, 409, 429 and 5xx twice with backoff. No idempotency keys, though session creation accepts a caller-chosen `sessionId` (10). Support and uptime SLAs are listed for Enterprise only on the pricing page re-read on 1 November, with no terms published (3). The sessions API is not marked beta (10)." }, "scores": { "a": 25, "b": 63 } }, { "by": 24, "category": "ergonomics", "leads": "steel", "name": "Agent ergonomics", "reasons": { "a": "Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.", "b": "Scrape returns only the formats asked for (HTML, cleaned HTML, Markdown or readability text), lists take `limit`, and the MCP server holds its 16 tool definitions to a 17,000 byte budget checked in CI, with a three-tool scrape profile (20). Sessions list by cursor with a `status` filter and a default page of 50, other lists take `limit` and `offset`, and traces filter by time and event type (17). Errors return `message`, `linkToDocs` and validation `context`, with documented 401 messages. No stable machine-readable error codes were found (15). No idempotency keys. A caller-chosen `sessionId`, `inactivityTimeout` and release-all help with retries and clean-up, and every MCP tool carries read-only, destructive or idempotent annotations (12). Session creation needs no parameters, and there are SDKs for Node and Python, with Rust and Go per Steel's blog (15)." }, "scores": { "a": 55, "b": 79 } }, { "by": 23, "category": "transparency", "leads": "steel", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.", "b": "Graded on the cloud service, which is closed with published terms. The browser runtime steel-browser and the SDKs are Apache-2.0, and the MCP server and CLI are MIT (24). The privacy notice (last updated 9 October 2026, re-read on 1 November) keeps data while an account exists, the pricing page gives 7 and 14 days of data retention, recordings can be turned off per session, and a DPA is linked as a Google Drive file. The terms date from 5 February 2025, the docs Legal page links to Google Docs copies, and the FAQ still describes pricing by concurrent sessions (14). No deprecation policy. Legacy plans stay available after the pricing change, and one docs note says a playback mode will be deprecated without a date (4). The privacy notice names Anthropic, OpenAI and Google Cloud AI as AI processors and says servers are in the United States, and the docs name one region, us-east. No subprocessor list was found outside the trust centre, which did not render for us (10)." }, "scores": { "a": 42, "b": 65 } }, { "by": 18, "category": "security", "leads": "steel", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.", "b": "Named API keys, shown once, revoked by deletion, with last-used times and a rotation guide. A global key covers the organisation and can create keys bound to one project through `POST /v1/api-keys`. No per-permission scopes were found (22). The documented CDP connection passes the key as `apiKey` in the `wss://connect.steel.dev` URL, a secret in a query string (minus 10). No read-only key. Projects isolate sessions, credentials and profiles, stored credentials are typed into pages without being shown to the agent, browser action endpoints reject localhost and private addresses since changelog 038, and the MCP server has a scrape-only profile and hands the browser to a person before logins and payments (13). The MCP server fences page content as untrusted and strips hidden text, and its README warns about injection. The API docs carry no such guidance (10). Session logs, recordings, Agent Traces, per-session cost and exports to JSON or CSV give the operator a per-call trail (13). A Vanta trust centre whose contents did not render for us, a HIPAA-ready BAA and SSO on Scale, and a disclosure policy with response times for the MCP server. No security.txt, bug bounty or certification report was found (8)." }, "scores": { "a": 38, "b": 56 } }, { "by": 17, "category": "maintenance", "leads": "steel", "name": "Maintenance \u0026 community", "reasons": { "a": "v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.", "b": "steel-browser v0.5.5-beta was tagged on 31 October 2026 and changelog 038 is dated 2 October (30). In the 90 days from 3 August, changelog entries on 18 and 25 September and 2 October, steel-browser v0.5.4-beta (25 August) and v0.5.5-beta (31 October), and the MCP server's 3.0.0 on main (9 September). The 24 July entry has left the window and no changelog entry has followed 038 (20). Public changelog, Discord and email support, and steel-browser merged 32 commits between v0.5.4-beta and v0.5.5-beta, among them fixes for session-ID validation in casting, `file://` blocking and a Node CVE. GitHub issue reply times were not read (15). Official SDKs exist, but the newest tags are steel-node v0.20.0 and steel-python v0.19.0 from 23 June, with no commit after 11 September, npm and PyPI didn't resolve from our shell on 1 November, and the MCP server is not in the MCP registry, per the 8 October check (9). CI workflows in steel-browser and a test, byte-budget and conformance suite in the MCP server. Whether they pass was not read (8)." }, "scores": { "a": 65, "b": 82 } } ], "facts": [ { "a": "Agent framework", "b": "HTTP API", "name": "Kind" }, { "a": "Ashish Yadav and contributors (ComputerUseAgent on GitHub)", "b": "Nen Labs, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.steel.dev", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP, stdio", "name": "Transports" }, { "a": "None", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "yes, from $0.01/call", "name": "x402" }, { "a": "MIT", "b": "Proprietary cloud service under Steel's terms. steel-browser and the Node and Python SDKs are Apache-2.0. The MCP server and the CLI are MIT", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-04", "b": "2026-10-31", "name": "Last release" }, { "a": "no document linked", "b": "2025-02-05", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-02-05", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "47k npm/wk, 63k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "2/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Steel scores 71.5 (BB) on agent readiness against AutoCua's 44.3 (E), and leads in every scored category.", "question": "Which is better for AI agents, AutoCua or Steel?" }, { "answer": "No hosted endpoint is listed for AutoCua. Steel has a hosted endpoint at https://api.steel.dev.", "question": "Can an agent call AutoCua and Steel without installing anything?" }, { "answer": "Yes. AutoCua is open source (MIT). Steel is open source (Proprietary cloud service under Steel's terms. steel-browser and the Node and Python SDKs are Apache-2.0. The MCP server and the CLI are MIT).", "question": "Are AutoCua and Steel open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No key needed to call it" ], "goodFor": "Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control.", "slug": "autocua", "watchFor": "Two weeks old at version 0.1.9, with no changelog file" }, { "aheadOn": [ "Reliability, 63 against 25", "Schema \u0026 documentation, 86 against 42", "Agent ergonomics, 79 against 55", "Security \u0026 auth, 56 against 38", "Payments \u0026 pricing, 75 against 60", "Maintenance \u0026 community, 82 against 65", "Transparency \u0026 trust, 65 against 42" ], "also": [ "Agent-ready, a grade of BB or better", "An agent can pay per call over x402, with no account", "A hosted endpoint, with nothing to install", "Runs on your own machine", "Free to start without a card" ], "goodFor": "Agents that need a real cloud browser with persistent profiles, stored logins, CAPTCHA solving and a human takeover path, and teams that want an open-source runtime they can also self-host.", "slug": "steel", "watchFor": "Two incidents of more than an hour hit session creation in the 90 days to 1 November 2026 (23 August, 1 October), per the status history read on 8 October" } ], "history": { "autocua": null, "steel": [ { "causes": [ "time" ], "date": "2026-11-01", "delta": 1, "from": 70.5, "fromGrade": "BB", "to": 71.5, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 70.4, "fromGrade": "BB", "to": 70.5, "toGrade": "BB" } ] }, "job": { "capability": "browser.control", "name": "Browser automation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agent-browser-vs-autocua.json", "title": "agent-browser vs AutoCua", "url": "https://www.anchorterminal.com/compare/agent-browser-vs-autocua" }, { "json": "https://www.anchorterminal.com/compare/agent-browser-vs-steel.json", "title": "agent-browser vs Steel", "url": "https://www.anchorterminal.com/compare/agent-browser-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/airtop-vs-autocua.json", "title": "Airtop vs AutoCua", "url": "https://www.anchorterminal.com/compare/airtop-vs-autocua" }, { "json": "https://www.anchorterminal.com/compare/airtop-vs-steel.json", "title": "Airtop vs Steel", "url": "https://www.anchorterminal.com/compare/airtop-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/anchor-browser-vs-autocua.json", "title": "Anchor Browser vs AutoCua", "url": "https://www.anchorterminal.com/compare/anchor-browser-vs-autocua" }, { "json": "https://www.anchorterminal.com/compare/anchor-browser-vs-steel.json", "title": "Anchor Browser vs Steel", "url": "https://www.anchorterminal.com/compare/anchor-browser-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-browser-use.json", "title": "AutoCua vs Browser Use", "url": "https://www.anchorterminal.com/compare/autocua-vs-browser-use" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-browserless.json", "title": "AutoCua vs Browserless", "url": "https://www.anchorterminal.com/compare/autocua-vs-browserless" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-bx-playwright.json", "title": "AutoCua vs BxPlaywright", "url": "https://www.anchorterminal.com/compare/autocua-vs-bx-playwright" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-chrome-devtools-mcp.json", "title": "AutoCua vs Chrome DevTools MCP", "url": "https://www.anchorterminal.com/compare/autocua-vs-chrome-devtools-mcp" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-functionize-mcp.json", "title": "AutoCua vs Functionize MCP server", "url": "https://www.anchorterminal.com/compare/autocua-vs-functionize-mcp" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-hyperbrowser.json", "title": "AutoCua vs Hyperbrowser", "url": "https://www.anchorterminal.com/compare/autocua-vs-hyperbrowser" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-kane-cli.json", "title": "AutoCua vs Kane CLI", "url": "https://www.anchorterminal.com/compare/autocua-vs-kane-cli" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-lightpanda.json", "title": "AutoCua vs Lightpanda", "url": "https://www.anchorterminal.com/compare/autocua-vs-lightpanda" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-notte.json", "title": "AutoCua vs Notte", "url": "https://www.anchorterminal.com/compare/autocua-vs-notte" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-playwright-mcp.json", "title": "AutoCua vs Playwright MCP", "url": "https://www.anchorterminal.com/compare/autocua-vs-playwright-mcp" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-pomerado.json", "title": "AutoCua vs Pomerado", "url": "https://www.anchorterminal.com/compare/autocua-vs-pomerado" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-puppeteer.json", "title": "AutoCua vs Puppeteer", "url": "https://www.anchorterminal.com/compare/autocua-vs-puppeteer" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-puppeteer-reference-server-archived.json", "title": "AutoCua vs Puppeteer (archived MCP reference server)", "url": "https://www.anchorterminal.com/compare/autocua-vs-puppeteer-reference-server-archived" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-robocorp.json", "title": "AutoCua vs Robocorp", "url": "https://www.anchorterminal.com/compare/autocua-vs-robocorp" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-selenium.json", "title": "AutoCua vs Selenium", "url": "https://www.anchorterminal.com/compare/autocua-vs-selenium" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-skyvern.json", "title": "AutoCua vs Skyvern", "url": "https://www.anchorterminal.com/compare/autocua-vs-skyvern" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-tinyfish.json", "title": "AutoCua vs TinyFish", "url": "https://www.anchorterminal.com/compare/autocua-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/browser-use-vs-steel.json", "title": "Browser Use vs Steel", "url": "https://www.anchorterminal.com/compare/browser-use-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/browserless-vs-steel.json", "title": "Browserless vs Steel", "url": "https://www.anchorterminal.com/compare/browserless-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/bx-playwright-vs-steel.json", "title": "BxPlaywright vs Steel", "url": "https://www.anchorterminal.com/compare/bx-playwright-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/chrome-devtools-mcp-vs-steel.json", "title": "Chrome DevTools MCP vs Steel", "url": "https://www.anchorterminal.com/compare/chrome-devtools-mcp-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/functionize-mcp-vs-steel.json", "title": "Functionize MCP server vs Steel", "url": "https://www.anchorterminal.com/compare/functionize-mcp-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/hyperbrowser-vs-steel.json", "title": "Hyperbrowser vs Steel", "url": "https://www.anchorterminal.com/compare/hyperbrowser-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/kane-cli-vs-steel.json", "title": "Kane CLI vs Steel", "url": "https://www.anchorterminal.com/compare/kane-cli-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/lightpanda-vs-steel.json", "title": "Lightpanda vs Steel", "url": "https://www.anchorterminal.com/compare/lightpanda-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/notte-vs-steel.json", "title": "Notte vs Steel", "url": "https://www.anchorterminal.com/compare/notte-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/playwright-mcp-vs-steel.json", "title": "Playwright MCP vs Steel", "url": "https://www.anchorterminal.com/compare/playwright-mcp-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/pomerado-vs-steel.json", "title": "Pomerado vs Steel", "url": "https://www.anchorterminal.com/compare/pomerado-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/puppeteer-reference-server-archived-vs-steel.json", "title": "Puppeteer (archived MCP reference server) vs Steel", "url": "https://www.anchorterminal.com/compare/puppeteer-reference-server-archived-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/puppeteer-vs-steel.json", "title": "Puppeteer vs Steel", "url": "https://www.anchorterminal.com/compare/puppeteer-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/selenium-vs-steel.json", "title": "Selenium vs Steel", "url": "https://www.anchorterminal.com/compare/selenium-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/skyvern-vs-steel.json", "title": "Skyvern vs Steel", "url": "https://www.anchorterminal.com/compare/skyvern-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/steel-vs-tinyfish.json", "title": "Steel vs TinyFish", "url": "https://www.anchorterminal.com/compare/steel-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/browserbase-vs-steel.json", "title": "Browserbase vs Steel", "url": "https://www.anchorterminal.com/compare/browserbase-vs-steel" } ], "panel": null, "scores": [ { "autocua": 25, "by": 38, "edge": "steel", "key": "reliability", "name": "Reliability", "steel": 63, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "autocua": 42, "by": 44, "edge": "steel", "key": "schema", "name": "Schema \u0026 documentation", "steel": 86, "weight": 13 }, { "autocua": 55, "by": 24, "edge": "steel", "key": "ergonomics", "name": "Agent ergonomics", "steel": 79, "weight": 13 }, { "autocua": 38, "by": 18, "edge": "steel", "key": "security", "name": "Security \u0026 auth", "steel": 56, "weight": 14 }, { "autocua": 60, "by": 15, "edge": "steel", "key": "payments", "name": "Payments \u0026 pricing", "steel": 75, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "autocua": 65, "by": 17, "edge": "steel", "key": "maintenance", "name": "Maintenance \u0026 community", "steel": 82, "weight": 7 }, { "autocua": 42, "by": 23, "edge": "steel", "key": "transparency", "name": "Transparency \u0026 trust", "steel": 65, "weight": 7 } ], "summary": "Steel scores 71.5 (BB) on agent readiness against AutoCua's 44.3 (E), and leads in every scored category. Both do browser automation. Steel accepts x402. AutoCua doesn't.", "tasks": null, "tutorials": [], "verdicts": { "autocua": "A capable, fast-moving open-source agent for driving desktops, browsers and phones through real input and accessibility trees, with a careful safety section. It's two weeks old, with no test CI or changelog, and on Windows the model itself decides whether to accept an admin elevation prompt.", "steel": "The hosted API has a public OpenAPI document, per-unit prices, $30 of starting credit and x402 payment for scrape, screenshot and PDF calls. Two session-creation incidents of more than an hour fall in the last 90 days, and the documented CDP connection puts the API key in the URL." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/autocua-vs-steel", "json": "https://www.anchorterminal.com/compare/autocua-vs-steel.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/autocua-vs-steel.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/autocua-vs-steel.min.md" }, "markdown": "Steel scores 71.5 (BB) on agent readiness against AutoCua's 44.3 (E), and leads in every scored category. Both do browser automation. Steel accepts x402. AutoCua doesn't.\n\n- AutoCua: grade E, 44.3/100, rank #1100 of 1354. Markdown https://www.anchorterminal.com/tools/autocua.md · JSON https://www.anchorterminal.com/api/v1/tools/autocua.json\n- Steel: grade BB, 71.5/100, rank #140 of 1354. Markdown https://www.anchorterminal.com/tools/steel.md · JSON https://www.anchorterminal.com/api/v1/tools/steel.json\n- Best desktop and mobile app automation for AI agents: https://www.anchorterminal.com/best/desktop-automation/index.md\n- All 48 desktop comparisons: https://www.anchorterminal.com/compare/desktop-automation/index.md\n- Best browser automation tools for AI agents: https://www.anchorterminal.com/best/browser/index.md\n- All 230 browser comparisons: https://www.anchorterminal.com/compare/browser/index.md\n\n## Which one, for what\n\n### AutoCua (E)\n\nGood for: Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control.\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: Two weeks old at version 0.1.9, with no changelog file\n\n### Steel (BB)\n\nGood for: Agents that need a real cloud browser with persistent profiles, stored logins, CAPTCHA solving and a human takeover path, and teams that want an open-source runtime they can also self-host.\n\nAhead on:\n- Reliability, 63 against 25\n- Schema \u0026 documentation, 86 against 42\n- Agent ergonomics, 79 against 55\n- Security \u0026 auth, 56 against 38\n- Payments \u0026 pricing, 75 against 60\n- Maintenance \u0026 community, 82 against 65\n- Transparency \u0026 trust, 65 against 42\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- An agent can pay per call over x402, with no account\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: Two incidents of more than an hour hit session creation in the 90 days to 1 November 2026 (23 August, 1 October), per the status history read on 8 October\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Steel +44\n\n- AutoCua (42): Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.\n- Steel (86): OpenAPI 3.0.3 at docs.steel.dev/openapi.json with 51 paths and 75 operations and the `steel-api-key` header scheme (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). 65 of 75 operations carry a description, and the MCP server's tool descriptions say when to use each tool and when to pick another (16). Inputs are typed with enums, UUID formats and list limits of 1 to 100, but `timeout` and `concurrency` carry no real bounds and `useProxy` and `region` have no stated type (11). One shared error schema is attached to most operations and the docs have error tables for Browser Tools and Agent Traces. The spec holds one example, and 429 is declared on session creation only (11). Paths are versioned under /v1 and the changelog is public and numbered, with dates in page metadata. The spec's own version reads 0.0.1 (13).\n\n### Reliability: Steel +38\n\n- AutoCua (25): Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.\n- Steel (63): Graded as a hosted service, on Steel Cloud. status.steel.dev runs on Better Stack with Steel API, Dashboard, Proxies and Connections components and 90 days of history, per the 8 October check (20). On 1 November its robots.txt disallows every path, so the history wasn't re-read. Per the 8 October check, the 4 hour 10 minute outage of 22 July 2026 has now left the 90-day window, leaving two majors in it, 5 hours 41 minutes of capacity errors on session creation on 23 August and 1 hour 55 minutes of failing session creation on 1 October. Two majors give 5, and anything posted after 8 October is unread, which would also score 5 as no readable history (5). Limits are published per plan, 60 and 600 requests a minute and 10 and 100 concurrent sessions, re-read on 1 November, and 20 a minute on Browser Tools (15). Browser Tools document 429 and a 503 marked safe to retry, the Agent Traces API says to wait for `Retry-After`, and the SDKs retry 408, 409, 429 and 5xx twice with backoff. No idempotency keys, though session creation accepts a caller-chosen `sessionId` (10). Support and uptime SLAs are listed for Enterprise only on the pricing page re-read on 1 November, with no terms published (3). The sessions API is not marked beta (10).\n\n### Agent ergonomics: Steel +24\n\n- AutoCua (55): Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.\n- Steel (79): Scrape returns only the formats asked for (HTML, cleaned HTML, Markdown or readability text), lists take `limit`, and the MCP server holds its 16 tool definitions to a 17,000 byte budget checked in CI, with a three-tool scrape profile (20). Sessions list by cursor with a `status` filter and a default page of 50, other lists take `limit` and `offset`, and traces filter by time and event type (17). Errors return `message`, `linkToDocs` and validation `context`, with documented 401 messages. No stable machine-readable error codes were found (15). No idempotency keys. A caller-chosen `sessionId`, `inactivityTimeout` and release-all help with retries and clean-up, and every MCP tool carries read-only, destructive or idempotent annotations (12). Session creation needs no parameters, and there are SDKs for Node and Python, with Rust and Go per Steel's blog (15).\n\n### Transparency \u0026 trust: Steel +23\n\n- AutoCua (42): MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.\n- Steel (65): Graded on the cloud service, which is closed with published terms. The browser runtime steel-browser and the SDKs are Apache-2.0, and the MCP server and CLI are MIT (24). The privacy notice (last updated 9 October 2026, re-read on 1 November) keeps data while an account exists, the pricing page gives 7 and 14 days of data retention, recordings can be turned off per session, and a DPA is linked as a Google Drive file. The terms date from 5 February 2025, the docs Legal page links to Google Docs copies, and the FAQ still describes pricing by concurrent sessions (14). No deprecation policy. Legacy plans stay available after the pricing change, and one docs note says a playback mode will be deprecated without a date (4). The privacy notice names Anthropic, OpenAI and Google Cloud AI as AI processors and says servers are in the United States, and the docs name one region, us-east. No subprocessor list was found outside the trust centre, which did not render for us (10).\n\n### Security \u0026 auth: Steel +18\n\n- AutoCua (38): Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.\n- Steel (56): Named API keys, shown once, revoked by deletion, with last-used times and a rotation guide. A global key covers the organisation and can create keys bound to one project through `POST /v1/api-keys`. No per-permission scopes were found (22). The documented CDP connection passes the key as `apiKey` in the `wss://connect.steel.dev` URL, a secret in a query string (minus 10). No read-only key. Projects isolate sessions, credentials and profiles, stored credentials are typed into pages without being shown to the agent, browser action endpoints reject localhost and private addresses since changelog 038, and the MCP server has a scrape-only profile and hands the browser to a person before logins and payments (13). The MCP server fences page content as untrusted and strips hidden text, and its README warns about injection. The API docs carry no such guidance (10). Session logs, recordings, Agent Traces, per-session cost and exports to JSON or CSV give the operator a per-call trail (13). A Vanta trust centre whose contents did not render for us, a HIPAA-ready BAA and SSO on Scale, and a disclosure policy with response times for the MCP server. No security.txt, bug bounty or certification report was found (8).\n\n### Maintenance \u0026 community: Steel +17\n\n- AutoCua (65): v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.\n- Steel (82): steel-browser v0.5.5-beta was tagged on 31 October 2026 and changelog 038 is dated 2 October (30). In the 90 days from 3 August, changelog entries on 18 and 25 September and 2 October, steel-browser v0.5.4-beta (25 August) and v0.5.5-beta (31 October), and the MCP server's 3.0.0 on main (9 September). The 24 July entry has left the window and no changelog entry has followed 038 (20). Public changelog, Discord and email support, and steel-browser merged 32 commits between v0.5.4-beta and v0.5.5-beta, among them fixes for session-ID validation in casting, `file://` blocking and a Node CVE. GitHub issue reply times were not read (15). Official SDKs exist, but the newest tags are steel-node v0.20.0 and steel-python v0.19.0 from 23 June, with no commit after 11 September, npm and PyPI didn't resolve from our shell on 1 November, and the MCP server is not in the MCP registry, per the 8 October check (9). CI workflows in steel-browser and a test, byte-budget and conformance suite in the MCP server. Whether they pass was not read (8).\n\n## Score by category\n\n| Category | Weight | AutoCua | Steel | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 25 | 63 | Steel +38 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 42 | 86 | Steel +44 |\n| Agent ergonomics | 13% (16.2 this run) | 55 | 79 | Steel +24 |\n| Security \u0026 auth | 14% (17.5 this run) | 38 | 56 | Steel +18 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 75 | Steel +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 65 | 82 | Steel +17 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 42 | 65 | Steel +23 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **44.3 · E** | **71.5 · BB** | |\n\n## Facts side by side\n\n| Fact | AutoCua | Steel |\n| --- | --- | --- |\n| Kind | Agent framework | HTTP API |\n| Vendor | Ashish Yadav and contributors (ComputerUseAgent on GitHub) | Nen Labs, Inc. |\n| Hosted endpoint | no (local only) | `https://api.steel.dev` |\n| Transports | | HTTP, stdio |\n| Auth | None | API key |\n| Pricing | Free | Freemium |\n| x402 | no | yes, from $0.01/call |\n| Licence | MIT | Proprietary cloud service under Steel's terms. steel-browser and the Node and Python SDKs are Apache-2.0. The MCP server and the CLI are MIT |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-11-04 | 2026-10-31 |\n| Terms last updated | no document linked | 2025-02-05 |\n| Privacy policy last updated | no document linked | 2026-02-05 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | none | 47k npm/wk, 63k PyPI/wk |\n| Agent reviews | none | 2/5 (4) |\n\n## How the scores have moved\n\n### AutoCua\n\nNo score change since it was listed.\n\n### Steel\n\n- +1.0 on 1 November 2026: time\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**AutoCua.** A capable, fast-moving open-source agent for driving desktops, browsers and phones through real input and accessibility trees, with a careful safety section. It's two weeks old, with no test CI or changelog, and on Windows the model itself decides whether to accept an admin elevation prompt.\n\n**Steel.** The hosted API has a public OpenAPI document, per-unit prices, $30 of starting credit and x402 payment for scrape, screenshot and PDF calls. Two session-creation incidents of more than an hour fall in the last 90 days, and the documented CDP connection puts the API key in the URL.\n\n## Before you call either\n\n### AutoCua\n\n1. pip install AutoCua, then call run_agent with a mode such as \"web use\" or \"computer use\", a provider, a model and a task\n2. Run it on a machine or account you can afford to lose; it drives real input and keeps logged-in browser profiles\n3. On Windows, don't install the Interception driver unless you accept the model deciding UAC prompts\n4. Set AutoCua_DATA_DIR to keep keys and profiles somewhere private\n5. Phones go over USB from a script; Wi-Fi only through the desktop app\n\n### Steel\n\n1. Use `POST /v1/scrape` for pages you only need to read. It starts no session and costs $5 per 1,000 calls, or $0.01 a call by x402\n2. Release every session with `POST /v1/sessions/{id}/release` and set `inactivityTimeout`. Browser time bills by the minute, rounded up\n3. Build the CDP URL as `wss://connect.steel.dev?apiKey=\u003ckey\u003e\u0026sessionId=\u003cid\u003e` and keep it out of logs, because it carries the key\n4. Launch sessions end after 15 minutes at most, and `timeout` cannot be changed on a live session\n5. CAPTCHA solving and Steel's managed proxies on Launch need $10 of paid balance. Free credit does not count\n\n## Questions\n\n### Which is better for AI agents, AutoCua or Steel?\n\nSteel scores 71.5 (BB) on agent readiness against AutoCua's 44.3 (E), and leads in every scored category.\n\n### Can an agent call AutoCua and Steel without installing anything?\n\nNo hosted endpoint is listed for AutoCua. Steel has a hosted endpoint at https://api.steel.dev.\n\n### Are AutoCua and Steel open source?\n\nYes. AutoCua is open source (MIT). Steel is open source (Proprietary cloud service under Steel's terms. steel-browser and the Node and Python SDKs are Apache-2.0. The MCP server and the CLI are MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/autocua-vs-steel.json, and with the fewest tokens: https://www.anchorterminal.com/compare/autocua-vs-steel.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"autocua\", \"b\": \"steel\"}`. From a terminal: `anchor compare autocua steel`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/autocua.json and https://www.anchorterminal.com/api/v1/tools/steel.json\n\n## Other comparisons with AutoCua or Steel\n\n- [agent-browser vs AutoCua](https://www.anchorterminal.com/compare/agent-browser-vs-autocua.md)\n- [agent-browser vs Steel](https://www.anchorterminal.com/compare/agent-browser-vs-steel.md)\n- [Airtop vs AutoCua](https://www.anchorterminal.com/compare/airtop-vs-autocua.md)\n- [Airtop vs Steel](https://www.anchorterminal.com/compare/airtop-vs-steel.md)\n- [Anchor Browser vs AutoCua](https://www.anchorterminal.com/compare/anchor-browser-vs-autocua.md)\n- [Anchor Browser vs Steel](https://www.anchorterminal.com/compare/anchor-browser-vs-steel.md)\n- [AutoCua vs Browser Use](https://www.anchorterminal.com/compare/autocua-vs-browser-use.md)\n- [AutoCua vs Browserless](https://www.anchorterminal.com/compare/autocua-vs-browserless.md)\n- [AutoCua vs BxPlaywright](https://www.anchorterminal.com/compare/autocua-vs-bx-playwright.md)\n- [AutoCua vs Chrome DevTools MCP](https://www.anchorterminal.com/compare/autocua-vs-chrome-devtools-mcp.md)\n- [AutoCua vs Functionize MCP server](https://www.anchorterminal.com/compare/autocua-vs-functionize-mcp.md)\n- [AutoCua vs Hyperbrowser](https://www.anchorterminal.com/compare/autocua-vs-hyperbrowser.md)\n- [AutoCua vs Kane CLI](https://www.anchorterminal.com/compare/autocua-vs-kane-cli.md)\n- [AutoCua vs Lightpanda](https://www.anchorterminal.com/compare/autocua-vs-lightpanda.md)\n- [AutoCua vs Notte](https://www.anchorterminal.com/compare/autocua-vs-notte.md)\n- [AutoCua vs Playwright MCP](https://www.anchorterminal.com/compare/autocua-vs-playwright-mcp.md)\n- [AutoCua vs Pomerado](https://www.anchorterminal.com/compare/autocua-vs-pomerado.md)\n- [AutoCua vs Puppeteer](https://www.anchorterminal.com/compare/autocua-vs-puppeteer.md)\n- [AutoCua vs Puppeteer (archived MCP reference server)](https://www.anchorterminal.com/compare/autocua-vs-puppeteer-reference-server-archived.md)\n- [AutoCua vs Robocorp](https://www.anchorterminal.com/compare/autocua-vs-robocorp.md)\n- [AutoCua vs Selenium](https://www.anchorterminal.com/compare/autocua-vs-selenium.md)\n- [AutoCua vs Skyvern](https://www.anchorterminal.com/compare/autocua-vs-skyvern.md)\n- [AutoCua vs TinyFish](https://www.anchorterminal.com/compare/autocua-vs-tinyfish.md)\n- [Browser Use vs Steel](https://www.anchorterminal.com/compare/browser-use-vs-steel.md)\n- [Browserless vs Steel](https://www.anchorterminal.com/compare/browserless-vs-steel.md)\n- [BxPlaywright vs Steel](https://www.anchorterminal.com/compare/bx-playwright-vs-steel.md)\n- [Chrome DevTools MCP vs Steel](https://www.anchorterminal.com/compare/chrome-devtools-mcp-vs-steel.md)\n- [Functionize MCP server vs Steel](https://www.anchorterminal.com/compare/functionize-mcp-vs-steel.md)\n- [Hyperbrowser vs Steel](https://www.anchorterminal.com/compare/hyperbrowser-vs-steel.md)\n- [Kane CLI vs Steel](https://www.anchorterminal.com/compare/kane-cli-vs-steel.md)\n- [Lightpanda vs Steel](https://www.anchorterminal.com/compare/lightpanda-vs-steel.md)\n- [Notte vs Steel](https://www.anchorterminal.com/compare/notte-vs-steel.md)\n- [Playwright MCP vs Steel](https://www.anchorterminal.com/compare/playwright-mcp-vs-steel.md)\n- [Pomerado vs Steel](https://www.anchorterminal.com/compare/pomerado-vs-steel.md)\n- [Puppeteer (archived MCP reference server) vs Steel](https://www.anchorterminal.com/compare/puppeteer-reference-server-archived-vs-steel.md)\n- [Puppeteer vs Steel](https://www.anchorterminal.com/compare/puppeteer-vs-steel.md)\n- [Selenium vs Steel](https://www.anchorterminal.com/compare/selenium-vs-steel.md)\n- [Skyvern vs Steel](https://www.anchorterminal.com/compare/skyvern-vs-steel.md)\n- [Steel vs TinyFish](https://www.anchorterminal.com/compare/steel-vs-tinyfish.md)\n- [Browserbase vs Steel](https://www.anchorterminal.com/compare/browserbase-vs-steel.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-06", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AutoCua vs Steel", "url": "" } ], "description": "Steel scores 71.5 (BB) to AutoCua's 44.3 (E) for browser automation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AutoCua E 44.3", "Steel BB 71.5", "scores" ], "h1": "AutoCua vs Steel", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/autocua-vs-steel", "published": "2026-10-01", "section": "tools", "title": "AutoCua vs Steel for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/autocua-vs-steel" }, "tokens": { "markdown": 5100, "slim": 3030 }, "version": 1 }