{ "data": { "a": { "slug": "autocua", "name": "AutoCua", "vendor": "Ashish Yadav and contributors (ComputerUseAgent on GitHub)", "vendorUrl": "https://github.com/ComputerUseAgent/AutoCua", "kind": "framework", "category": "desktop-automation", "summary": "AutoCua is an open-source Python agent that operates a computer the way a person does, desktop apps, a terminal, your own Chrome and iOS or Android phones, with any of 60 models from ten providers.", "url": "https://www.anchorterminal.com/tools/autocua", "markdownUrl": "https://www.anchorterminal.com/tools/autocua.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/autocua.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/autocua.json", "dns": "autocua.grade.anchorterminal.com", "repo": "https://github.com/ComputerUseAgent/AutoCua", "license": "MIT", "transports": [], "packages": [ { "registry": "pypi", "name": "AutoCua" } ], "auth": "none", "authNotes": "No account. You bring an API key for the model provider you choose, kept with chats, Chrome profiles and a credential vault in a local AutoCua_data folder.", "pricing": "free", "pricingNotes": "Free and MIT-licensed. You pay your model provider for tokens. Nothing to buy from the project (checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "A local package with nothing to buy and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/ComputerUseAgent/AutoCua#readme", "capabilities": [ "browser.control", "agent.run" ], "tags": [ "open-source", "mit", "python", "computer-use", "local", "new" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 44.3, "grade": "E", "agentReady": false, "rank": 1100, "ranked": true, "rankOf": 1354, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 55, "maintenance": 65, "payments": 60, "reliability": 25, "schema": 42, "security": 38, "transparency": 42 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "A capable, fast-moving open-source agent for driving desktops, browsers and phones through real input and accessibility trees, with a careful safety section. It's two weeks old, with no test CI or changelog, and on Windows the model itself decides whether to accept an admin elevation prompt.", "bestFor": "Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control.", "strengths": [ "One run_agent call drives the desktop, a terminal, your Chrome, or an iOS or Android device", "Element picking from accessibility trees and OCR instead of pixel coordinates", "Credentials typed from a vault so the model never sees them, in the browser and phone agents", "No telemetry, and nothing downloaded without a yes on the terminal", "MIT licence, a pip wheel per OS and architecture, and 60 models across ten providers" ], "weaknesses": [ "Two weeks old at version 0.1.9, with no changelog file", "No CI running the tests; the only workflow labels issues", "On Windows the model answers UAC elevation prompts itself through a kernel input driver", "Keeps API keys and logged-in Chrome profiles in a local folder next to the checkout", "No API reference beyond the README" ], "agentNotes": [ "pip install AutoCua, then call run_agent with a mode such as \"web use\" or \"computer use\", a provider, a model and a task", "Run it on a machine or account you can afford to lose; it drives real input and keeps logged-in browser profiles", "On Windows, don't install the Interception driver unless you accept the model deciding UAC prompts", "Set AutoCua_DATA_DIR to keep keys and profiles somewhere private", "Phones go over USB from a script; Wi-Fi only through the desktop app" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 44.3 } ], "editorialScores": { "ergonomics": 55, "maintenance": 65, "payments": 60, "reliability": 25, "schema": 42, "security": 38, "transparency": 70 }, "provenanceScore": 13, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install AutoCua\n# then, in Python:\n# from AutoCua.agent_launcher import run_agent\n# run_agent(mode=\"web use\", provider=\"openrouter\", model=\"gemini-3.8-flash\", task=\"Open wikipedia.org and summarise today's featured article.\")" }, "letme": { "capability": "https://letme.dev/browser.control", "tool": "https://letme.dev/autocua" }, "area": "developer", "provenance": { "legalEntity": "", "domain": "github.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The licence names Ashish Yadav as copyright holder; most commits are from the GitHub user FunctionFreak. No company, site or terms were found.", "github.com/AutoCua/AutoCua and github.com/ComputerUseAgent/AutoCua serve the same main branch, so one is a rename or mirror of the other." ], "score": 13 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/autocua.json" }, "answer": "TinyFish scores 68.2 (B) on agent readiness against AutoCua's 44.3 (E), and leads in 6 of 7 scored categories. AutoCua leads on payments \u0026 pricing.", "b": { "slug": "tinyfish", "name": "TinyFish", "vendor": "TinyFish", "vendorUrl": "https://www.tinyfish.ai", "kind": "http-api", "category": "browser", "summary": "TinyFish is a hosted web agent platform from Tiny Fish, Inc. Agents call it through REST APIs for goal-driven automation, remote browser sessions over CDP, search, fetch and research, or through a remote MCP server with OAuth.", "url": "https://www.anchorterminal.com/tools/tinyfish", "markdownUrl": "https://www.anchorterminal.com/tools/tinyfish.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/tinyfish.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/tinyfish.json", "dns": "tinyfish.grade.anchorterminal.com", "repo": "https://github.com/tinyfish-io/tinyfish-mcp-server", "license": "Proprietary service under Tiny Fish's terms of service. The MCP proxy `@tiny-fish/mcp` and the cookbook are MIT. The SDK packages state no licence in npm or PyPI metadata", "transports": [ "http" ], "remoteUrl": "https://agent.tinyfish.ai", "packages": [ { "registry": "pypi", "name": "tinyfish" }, { "registry": "npm", "name": "@tiny-fish/sdk" }, { "registry": "npm", "name": "@tiny-fish/cli" }, { "registry": "npm", "name": "@tiny-fish/mcp" } ], "auth": "mixed", "authNotes": "Self-serve API key from agent.tinyfish.ai/api-keys, sent in the `X-API-Key` header on every REST call. Keys are shown once and can be deleted, and no scopes were found. The MCP server at `https://agent.tinyfish.ai/mcp` uses OAuth 2.1 with a browser sign-in, or a key as a Bearer token for clients without OAuth. No sales approval is needed.", "pricing": "freemium", "pricingNotes": "Search and Fetch are free up to 12,000 requests and 1,000 URLs a day. Agent runs cost $0.016 a step and Browser sessions $0.002 a minute, drawn from a prepaid wallet with a $10 minimum top-up and no subscription. New accounts start with $8 of wallet funds and need no card, so an agent's owner can start without a contract. Enterprise is by contract (https://www.tinyfish.ai/pricing).", "priceSummary": "$0.016 / call", "where": "hosted", "x402": { "level": "no", "evidence": "No x402 or L402 in the docs or the OpenAPI documents. `POST /v1/wallet/top-up` accepts the Machine Payments Protocol with a Stripe Shared Payment Token to refill the prepaid wallet ($10 to $500), for accounts in a gradual rollout and with an API key (https://docs.tinyfish.ai/agent-payments.md, checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 5721, "pypiWeekly": 6540, "asOf": "2026-10-08" }, "docsUrl": "https://docs.tinyfish.ai", "llmsTxt": "https://docs.tinyfish.ai/llms.txt", "openapi": "https://agent.tinyfish.ai/v1/openapi/main", "registryName": "ai.tinyfish.agent/web-agent", "capabilities": [ "browser.control", "browser.hosted", "web.extract", "web.fetch", "web.search", "search.research", "scraping.proxies", "scraping.anti-bot" ], "tags": [ "official", "hosted", "freemium", "no-card", "prepaid", "mpp", "openapi", "llms-txt", "mcp", "oauth", "api-key", "python", "typescript", "cli", "webhooks", "status-page", "pre-1.0" ], "lastRelease": "2026-10-24", "graded": true, "anchor": { "graded": true, "score": 68.2, "grade": "B", "agentReady": false, "rank": 268, "ranked": true, "rankOf": 1354, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 80, "payments": 55, "reliability": 60, "schema": 85, "security": 60, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "OpenAPI documents are published for seven APIs, errors carry typed codes and request IDs, and Search and Fetch are free within daily allowances. The terms let Tiny Fish train its models on customer data, run creation takes no idempotency keys, and the status page showed an hour or more of downtime on several days for the Browser and Search APIs.", "bestFor": "Agents that want one account for a goal-driven web agent, a raw CDP browser, and free search and fetch.", "strengths": [ "OpenAPI 3.0 documents for seven APIs (Agent, Browser, Datasets, Fetch, Monitor, Research, Search), plus `llms.txt`, `llms-full.txt` and a Markdown twin of every docs page", "Search and Fetch are free up to 12,000 requests and 1,000 URLs a day, and new accounts start with $8 of wallet funds with no card", "Errors carry a code, a message, optional `details` and a `request_id`. Search and Fetch 429s carry `Retry-After` and `X-RateLimit-*` headers", "Remote MCP server at `https://agent.tinyfish.ai/mcp` with OAuth 2.1, listed in the official MCP registry as `ai.tinyfish.agent/web-agent`", "Vault credentials from 1Password or Bitwarden are opt-in per run and can be limited with `credential_item_ids`. The docs say the agent never sees the passwords", "A valid security.txt and a disclosure policy (v1.1, 15 September 2026) with safe harbour and response times" ], "weaknesses": [ "The terms of 17 August 2026 allow Tiny Fish to train and improve its models on customer data. No opt-out was found in the reviewed pages", "Per the 8 October read, the status page showed downtime of an hour or more on six days for the Browser API and five for the Search API from 11 July, with no incident write-ups", "No idempotency keys on run or session creation. The docs say retrying a failed request may create duplicate runs", "API keys have no scopes and no read-only mode was found. Prompt-injection guidance covers only Search results in one integration guide", "No retention periods, public DPA or subprocessor list on the pages we could read. The trust centre is drawn by script and was unread", "The Pulse changelog's newest entry is still 22 June 2026, and the Python and TypeScript SDKs are 0.x with no public source repository found" ], "agentNotes": [ "Check `result` as well as `status`. A run can be `COMPLETED` while the goal failed, with `result.status` set to `failure`", "Don't retry `POST /v1/automation/run` blindly after a timeout. There are no idempotency keys, so list runs first to avoid duplicates", "Use `/v1/automation/run-async` or `/run-sse` when a run may need cancelling. Runs started with the synchronous endpoint can't be cancelled", "Allow 60 seconds for Browser session creation, connect Playwright to `cdp_url` (not `base_url`), and `DELETE` the session when done because billing is per minute", "Never put passwords in `goal`, which is logged. Pass `use_vault: true` with `credential_item_ids`, or `use_profile: true` for saved login state" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.2 } ], "editorialScores": { "ergonomics": 79, "maintenance": 80, "payments": 55, "reliability": 60, "schema": 85, "security": 60, "transparency": 32 }, "provenanceScore": 86, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install -U tinyfish", "http": "curl -X POST https://agent.tinyfish.ai/v1/automation/run -H \"X-API-Key: $TINYFISH_API_KEY\" -H \"Content-Type: application/json\" -d '{\"url\": \"https://example.com\", \"goal\": \"Extract the page title\"}'", "claudeCode": "claude mcp add --transport http tinyfish https://agent.tinyfish.ai/mcp", "config": { "mcpServers": { "tinyfish": { "url": "https://agent.tinyfish.ai/mcp" } } } }, "letme": { "capability": "https://letme.dev/browser.control", "tool": "https://letme.dev/tinyfish" }, "sameCompany": [ "tinyfish-search" ], "area": "developer", "unitPrices": [ { "item": "Agent step", "unit": "call", "usd": 0.016, "note": "Model inference, residential proxy and anti-bot handling included per the pricing page" }, { "item": "Browser session", "unit": "browser-hour", "usd": 0.12, "note": "Billed at $0.002 a minute" }, { "item": "Search", "unit": "1k-requests", "usd": 0, "note": "Free up to 12,000 requests a day, 30 a minute" }, { "item": "Fetch", "unit": "1k-pages", "usd": 0, "note": "Free up to 1,000 URLs a day, 150 a minute" }, { "item": "Monitor run", "unit": "call", "usd": 0.005, "note": "Per completed run, failed runs free, per the MCP docs" } ], "provenance": { "legalEntity": "Tiny Fish, Inc.", "domain": "tinyfish.ai", "domainRegistered": "2023-02-06", "endpointOnVendorDomain": true, "terms": "https://www.tinyfish.ai/terms", "privacy": "https://www.tinyfish.ai/privacy-policy", "statusPage": "https://agent.tinyfish.ai/status", "changelog": "https://www.tinyfish.ai/pulse", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "The terms of service, effective 17 August 2026, name Tiny Fish, Inc., a Delaware corporation at 4410 El Camino Real, Los Altos, CA 94022, cover the APIs and the wallet, and choose California law.", "The privacy policy, effective 14 December 2025, names TinyFish Inc. in Cupertino, California, and covers the website, products and services.", "The APIs answer at agent.tinyfish.ai, api.browser.tinyfish.ai, api.search.tinyfish.ai and api.fetch.tinyfish.ai. The docs' example `cdp_url` is on a tinyfish.io subdomain, the vendor's second domain.", "www.tinyfish.ai/.well-known/security.txt gives a contact, a policy link and an expiry of 1 September 2027.", "RDAP for tinyfish.ai gives a registration date of 2023-02-06.", "Pulse, the product changelog, still has its newest entry dated 22 June 2026 on 1 November. Current release dates come from PyPI's release feed.", "The same GitHub organisation, tinyfish-io, publishes AgentQL, which is a separate product and isn't graded here.", "On 1 November agent.tinyfish.ai answered robots.txt with a redirect to its sign-in page, so the status page on that host wasn't re-read." ], "score": 86 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/tinyfish.json", "live": { "slug": "tinyfish", "probe": { "target": "https://agent.tinyfish.ai", "method": "get", "lastAt": "2026-11-06T09:47:54.030178674Z", "lastOk": true, "lastStatus": 200, "lastMs": 685, "authRequired": false, "uptime24h": 100, "uptime30d": 99.99, "p50ms24h": 665, "p95ms24h": 866, "samples24h": 221, "samples30d": 6963, "days": [ { "date": "2026-10-09", "probes": 169, "ok": 169 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 249 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 102, "ok": 102 } ] }, "vendorStatus": { "page": "https://agent.tinyfish.ai/status", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-06T05:42:44.116775602Z" }, "versions": [ { "registry": "mcp-registry", "name": "ai.tinyfish.agent/web-agent", "version": "1.0.1", "seenAt": "2026-11-05T17:32:31.346782632Z" }, { "registry": "npm", "name": "@tiny-fish/cli", "version": "0.57.0", "seenAt": "2026-11-05T22:14:01.064156739Z" }, { "registry": "npm", "name": "@tiny-fish/mcp", "version": "0.1.0", "seenAt": "2026-11-05T22:14:03.043999342Z" }, { "registry": "npm", "name": "@tiny-fish/sdk", "version": "0.11.0", "seenAt": "2026-11-05T22:14:00.833523028Z" }, { "registry": "pypi", "name": "tinyfish", "version": "0.11.0", "released": "2026-10-24", "seenAt": "2026-11-05T22:14:00.720640576Z" } ], "githubStars": 14, "npmWeekly": 6375, "pypiWeekly": 15998, "securityTxt": { "url": "https://tinyfish.ai/.well-known/security.txt", "state": "valid", "expires": "2027-09-01T00:00:00.000Z", "checkedAt": "2026-11-05T15:55:02.960235664Z" }, "llmsTxt": { "url": "https://docs.tinyfish.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-05T15:27:30.085771792Z" }, "domain": { "domain": "tinyfish.ai", "registered": "2023-02-06", "source": "https://rdap.identitydigital.services/rdap/domain/tinyfish.ai", "checkedAt": "2026-11-01T14:12:03.619363363Z" }, "github": { "repo": "tinyfish-io/tinyfish-mcp-server", "checkedAt": "2026-11-02T09:31:53.876341011Z", "stars": 14, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T10:38:22Z", "openIssues": 4, "openPRs": 8, "issuesOpened90d": 3, "issuesClosed90d": 0, "prsMerged90d": 6, "ci": { "branch": "main", "runs": 19, "success": 19, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-31T00:21:09Z" }, "replies": { "sampled": 4, "unanswered": 4 } }, "updatedAt": "2026-11-06T09:47:54.030178674Z" } }, "edges": [ { "by": 43, "category": "schema", "leads": "tinyfish", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.", "b": "Graded on the REST API. `llms.txt` now links OpenAPI documents for seven APIs (browser, datasets, fetch, main, monitor, research, search). They sit on agent.tinyfish.ai, which we treat as blocked since 1 November, so the counts below are per the 8 October check, not re-read on 1 November, from the main document (28 operations) and the Browser document (3) (25). `llms.txt`, a 531 KB `llms-full.txt`, a Markdown twin of every page and a single page for coding agents (10). All 31 operations read carry a description, several say which endpoint to pick instead, and the MCP tool definitions state when to use and when not to use each tool (17). 189 enums in the main document, ranges such as `max_steps` 1 to 500, and unknown fields rejected. 730 of 1,068 properties carry a description, `goal` is free text by design and the MCP `search` tool takes a JSON-encoded `fetch` string (12). 698 examples in the main document, every operation documents an error response, and an error-code page gives a fix for each code (14). The path is versioned `/v1`. The Pulse changelog still stops at 22 June 2026 and the docs have no API changelog (7). 25+10+17+12+14+7 = 85." }, "scores": { "a": 42, "b": 85 } }, { "by": 35, "category": "reliability", "leads": "tinyfish", "name": "Reliability", "reasons": { "a": "Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.", "b": "Graded as a hosted API. agent.tinyfish.ai/status is the vendor's own page with five components and 90 daily bars each, but no incident write-ups (15 of 20). On 1 November agent.tinyfish.ai answered its robots.txt with a redirect to a sign-in page, which we treat as a blocked host, so the page wasn't re-read. Per the 8 October check, not re-read on 1 November, the Agent API showed no downtime from 11 July to 8 October 2026, the Browser API 420 minutes across six days (120 on 28 September), the Search API 1,500 minutes across seven days (420 on 7 August) and the Fetch API 240 on 27 August. Several outages of an hour or more, so 5 of 30, which is also the value for an unread history, so the unread weeks from 9 October can't move it. Limits are published on the pricing page and in the docs (Search 30 requests a minute and 500 an hour, Fetch 150 URLs a minute, 2 concurrent Agent runs, 5 concurrent Browser sessions) (15). Search and Fetch 429s carry `Retry-After` and `X-RateLimit-*` headers, the docs give backoff guidance and the SDKs retry 429 and 5xx. The Agent pending-run 429 has no `Retry-After` and run creation has no idempotency keys (11). The pricing page lists a 99.99 per cent uptime SLA for Enterprise, with no SLA document found (5). Browser, Search and MCP were declared generally available in June 2026 and the API is `/v1`. The SDKs are 0.x and `max_steps` is still beta-gated (9). 15+5+15+11+5+9 = 60." }, "scores": { "a": 25, "b": 60 } }, { "by": 24, "category": "ergonomics", "leads": "tinyfish", "name": "Agent ergonomics", "reasons": { "a": "Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.", "b": "Fetch takes an output format, include and exclude selectors, a cache age and a per-URL timeout, and run reads choose whether screenshots come back as URLs or inline. The MCP docs page now lists 35 tools, among them dataset, monitor and research tools, and the proxy repository's reference (28 September) lists 28 (18). Run lists take a cursor, a limit of 1 to 100 and filters for status, goal text, dates and an `owner` of `me` or `team`, and Search pages from 0 to 10 (18). Errors carry a code, a message, optional `details` and a `request_id`, and wallet denials add `non_retryable` and balance fields (19). The docs still say run creation doesn't support idempotency keys and a retry may create duplicate runs. Cancels, research cancels and session deletes are idempotent and a replayed wallet top-up is credited once. We couldn't read MCP annotations without signing in (9). A run needs only `url` and `goal`, a browser session needs nothing, and there are official Python and TypeScript SDKs and a CLI (15). 18+18+19+9+15 = 79." }, "scores": { "a": 55, "b": 79 } }, { "by": 22, "category": "security", "leads": "tinyfish", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.", "b": "REST calls take an `X-API-Key` header. Keys are created and deleted in the dashboard and shown once, with no scopes found. Contract organisations add personal and workflow keys that admins can revoke, which separate ownership but not permissions. MCP uses OAuth 2.1, and run IDs are separated between CLI or REST tokens and MCP tokens (21). Vault credentials are opt-in per run with `use_vault` and can be limited with `credential_item_ids`, and the docs say the agent never sees passwords. Organisation workflow keys can't use vault credentials or profiles, and admins can set a spend cap that stops usage. No read-only key or approval step for agent actions was found, and `max_steps` is beta-gated (9). Pages are untrusted content. The plugin page mentions safety rules for untrusted content, and the Fireworks integration guide now tells callers to treat Search results as untrusted because they can contain prompt injection, with a system prompt that says never to follow instructions in them. The Agent and Browser docs carry no such guidance (6). Each run keeps per-step screenshots and optional HTML snapshots, usage lists exist for Search, Fetch and Browser sessions, and audit logs are listed under Enterprise (11). security.txt is valid until 1 September 2027, and the disclosure policy v1.1 of 15 September 2026 has safe harbour and discretionary rewards with no formal bounty. The terms and the pricing page cite ISO 27001, and the trust centre that would show it is drawn by script and was unread (13). 21+9+6+11+13 = 60." }, "scores": { "a": 38, "b": 60 } }, { "by": 17, "category": "transparency", "leads": "tinyfish", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.", "b": "The platform is closed with published terms, effective 17 August 2026. The MCP proxy and cookbook are MIT, and the SDK packages state no licence in npm or PyPI metadata (14). The terms allow Tiny Fish to review runs and to train and improve its models on customer data, which is stated plainly. The privacy policy of 14 December 2025 gives no retention periods and names TinyFish Inc. in Cupertino, while the terms name Tiny Fish, Inc. in Los Altos. No public DPA was found (10). No deprecation policy was found. The docs flag two parameters as deprecated without dates, and the terms give 30 days' notice of material changes to the terms (5). No subprocessor list or hosting location was found on readable pages. The enterprise page says data residency is agreed by contract, and the trust centre was unread (3). 14+10+5+3 = 32." }, "scores": { "a": 42, "b": 59 } }, { "by": 15, "category": "maintenance", "leads": "tinyfish", "name": "Maintenance \u0026 community", "reasons": { "a": "v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.", "b": "`tinyfish` 0.11.0 was published to PyPI on 24 October 2026 and 0.10.0 on 21 October, per PyPI's release feed (30). Eight Python SDK releases since 3 August (0.5.0 on 4 August to 0.11.0), counted half as SDK tags, still more than three (20). npm couldn't be read on 1 November, so the TypeScript SDK and CLI dates rest on the 8 October check (`@tiny-fish/cli` 0.48.1 on 7 October, `@tiny-fish/sdk` 0.8.0 on 29 September). The Pulse changelog still stops at 22 June 2026. Support is by e-mail and Discord, and the public MCP proxy repository has commits to 31 October. We didn't read issue reply times (8 of 15 on the closed-service line). The hosted MCP server is in the official MCP registry as `ai.tinyfish.agent/web-agent`, version 1.0.1, published 17 February 2026, and both SDKs are current (15). The MCP proxy repository runs CI, Renovate, and OSV and secrets scanners, cleared 11 OSV dependency findings on 6 October, and publishes through npm trusted publishing. The SDK packages name no source repository (7). 30+20+8+15+7 = 80." }, "scores": { "a": 65, "b": 80 } } ], "facts": [ { "a": "Agent framework", "b": "HTTP API", "name": "Kind" }, { "a": "Ashish Yadav and contributors (ComputerUseAgent on GitHub)", "b": "TinyFish", "name": "Vendor" }, { "a": "no (local only)", "b": "https://agent.tinyfish.ai", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "None", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Proprietary service under Tiny Fish's terms of service. The MCP proxy `@tiny-fish/mcp` and the cookbook are MIT. The SDK packages state no licence in npm or PyPI metadata", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "ai.tinyfish.agent/web-agent", "name": "MCP registry" }, { "a": "2026-11-04", "b": "2026-10-24", "name": "Last release" }, { "a": "no document linked", "b": "2026-08-17", "name": "Terms last updated" }, { "a": "no document linked", "b": "2025-12-14", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "5.7k npm/wk, 6.5k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "2.8/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "TinyFish scores 68.2 (B) on agent readiness against AutoCua's 44.3 (E), and leads in 6 of 7 scored categories. AutoCua leads on payments \u0026 pricing.", "question": "Which is better for AI agents, AutoCua or TinyFish?" }, { "answer": "No hosted endpoint is listed for AutoCua. TinyFish has a hosted endpoint at https://agent.tinyfish.ai.", "question": "Can an agent call AutoCua and TinyFish without installing anything?" }, { "answer": "AutoCua is open source (MIT). No open-source release is listed for TinyFish.", "question": "Are AutoCua and TinyFish open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 60 against 55" ], "also": [ "No key needed to call it", "Open source" ], "goodFor": "Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control.", "slug": "autocua", "watchFor": "Two weeks old at version 0.1.9, with no changelog file" }, { "aheadOn": [ "Reliability, 60 against 25", "Schema \u0026 documentation, 85 against 42", "Agent ergonomics, 79 against 55", "Security \u0026 auth, 60 against 38", "Maintenance \u0026 community, 80 against 65", "Transparency \u0026 trust, 59 against 42" ], "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card" ], "goodFor": "Agents that want one account for a goal-driven web agent, a raw CDP browser, and free search and fetch.", "slug": "tinyfish", "watchFor": "The terms of 17 August 2026 allow Tiny Fish to train and improve its models on customer data. No opt-out was found in the reviewed pages" } ], "history": { "autocua": null, "tinyfish": [ { "causes": [ "evidence" ], "date": "2026-11-01", "delta": 0.5, "from": 67.7, "fromGrade": "B", "to": 68.2, "toGrade": "B" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.1, "from": 67.8, "fromGrade": "B", "to": 67.7, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 67.7, "fromGrade": "B", "to": 67.8, "toGrade": "B" } ] }, "job": { "capability": "browser.control", "name": "Browser automation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agent-browser-vs-autocua.json", "title": "agent-browser vs AutoCua", "url": "https://www.anchorterminal.com/compare/agent-browser-vs-autocua" }, { "json": "https://www.anchorterminal.com/compare/agent-browser-vs-tinyfish.json", "title": "agent-browser vs TinyFish", "url": "https://www.anchorterminal.com/compare/agent-browser-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/airtop-vs-autocua.json", "title": "Airtop vs AutoCua", "url": "https://www.anchorterminal.com/compare/airtop-vs-autocua" }, { "json": "https://www.anchorterminal.com/compare/airtop-vs-tinyfish.json", "title": "Airtop vs TinyFish", "url": "https://www.anchorterminal.com/compare/airtop-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/anchor-browser-vs-autocua.json", "title": "Anchor Browser vs AutoCua", "url": "https://www.anchorterminal.com/compare/anchor-browser-vs-autocua" }, { "json": "https://www.anchorterminal.com/compare/anchor-browser-vs-tinyfish.json", "title": "Anchor Browser vs TinyFish", "url": "https://www.anchorterminal.com/compare/anchor-browser-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-browser-use.json", "title": "AutoCua vs Browser Use", "url": "https://www.anchorterminal.com/compare/autocua-vs-browser-use" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-browserless.json", "title": "AutoCua vs Browserless", "url": "https://www.anchorterminal.com/compare/autocua-vs-browserless" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-bx-playwright.json", "title": "AutoCua vs BxPlaywright", "url": "https://www.anchorterminal.com/compare/autocua-vs-bx-playwright" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-chrome-devtools-mcp.json", "title": "AutoCua vs Chrome DevTools MCP", "url": "https://www.anchorterminal.com/compare/autocua-vs-chrome-devtools-mcp" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-functionize-mcp.json", "title": "AutoCua vs Functionize MCP server", "url": "https://www.anchorterminal.com/compare/autocua-vs-functionize-mcp" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-hyperbrowser.json", "title": "AutoCua vs Hyperbrowser", "url": "https://www.anchorterminal.com/compare/autocua-vs-hyperbrowser" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-kane-cli.json", "title": "AutoCua vs Kane CLI", "url": "https://www.anchorterminal.com/compare/autocua-vs-kane-cli" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-lightpanda.json", "title": "AutoCua vs Lightpanda", "url": "https://www.anchorterminal.com/compare/autocua-vs-lightpanda" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-notte.json", "title": "AutoCua vs Notte", "url": "https://www.anchorterminal.com/compare/autocua-vs-notte" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-playwright-mcp.json", "title": "AutoCua vs Playwright MCP", "url": "https://www.anchorterminal.com/compare/autocua-vs-playwright-mcp" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-pomerado.json", "title": "AutoCua vs Pomerado", "url": "https://www.anchorterminal.com/compare/autocua-vs-pomerado" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-puppeteer.json", "title": "AutoCua vs Puppeteer", "url": "https://www.anchorterminal.com/compare/autocua-vs-puppeteer" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-puppeteer-reference-server-archived.json", "title": "AutoCua vs Puppeteer (archived MCP reference server)", "url": "https://www.anchorterminal.com/compare/autocua-vs-puppeteer-reference-server-archived" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-robocorp.json", "title": "AutoCua vs Robocorp", "url": "https://www.anchorterminal.com/compare/autocua-vs-robocorp" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-selenium.json", "title": "AutoCua vs Selenium", "url": "https://www.anchorterminal.com/compare/autocua-vs-selenium" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-skyvern.json", "title": "AutoCua vs Skyvern", "url": "https://www.anchorterminal.com/compare/autocua-vs-skyvern" }, { "json": "https://www.anchorterminal.com/compare/autocua-vs-steel.json", "title": "AutoCua vs Steel", "url": "https://www.anchorterminal.com/compare/autocua-vs-steel" }, { "json": "https://www.anchorterminal.com/compare/browser-use-vs-tinyfish.json", "title": "Browser Use vs TinyFish", "url": "https://www.anchorterminal.com/compare/browser-use-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/browserless-vs-tinyfish.json", "title": "Browserless vs TinyFish", "url": "https://www.anchorterminal.com/compare/browserless-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/bx-playwright-vs-tinyfish.json", "title": "BxPlaywright vs TinyFish", "url": "https://www.anchorterminal.com/compare/bx-playwright-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/chrome-devtools-mcp-vs-tinyfish.json", "title": "Chrome DevTools MCP vs TinyFish", "url": "https://www.anchorterminal.com/compare/chrome-devtools-mcp-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/functionize-mcp-vs-tinyfish.json", "title": "Functionize MCP server vs TinyFish", "url": "https://www.anchorterminal.com/compare/functionize-mcp-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/hyperbrowser-vs-tinyfish.json", "title": "Hyperbrowser vs TinyFish", "url": "https://www.anchorterminal.com/compare/hyperbrowser-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/kane-cli-vs-tinyfish.json", "title": "Kane CLI vs TinyFish", "url": "https://www.anchorterminal.com/compare/kane-cli-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/lightpanda-vs-tinyfish.json", "title": "Lightpanda vs TinyFish", "url": "https://www.anchorterminal.com/compare/lightpanda-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/notte-vs-tinyfish.json", "title": "Notte vs TinyFish", "url": "https://www.anchorterminal.com/compare/notte-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/playwright-mcp-vs-tinyfish.json", "title": "Playwright MCP vs TinyFish", "url": "https://www.anchorterminal.com/compare/playwright-mcp-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/pomerado-vs-tinyfish.json", "title": "Pomerado vs TinyFish", "url": "https://www.anchorterminal.com/compare/pomerado-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/puppeteer-reference-server-archived-vs-tinyfish.json", "title": "Puppeteer (archived MCP reference server) vs TinyFish", "url": "https://www.anchorterminal.com/compare/puppeteer-reference-server-archived-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/puppeteer-vs-tinyfish.json", "title": "Puppeteer vs TinyFish", "url": "https://www.anchorterminal.com/compare/puppeteer-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/selenium-vs-tinyfish.json", "title": "Selenium vs TinyFish", "url": "https://www.anchorterminal.com/compare/selenium-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/skyvern-vs-tinyfish.json", "title": "Skyvern vs TinyFish", "url": "https://www.anchorterminal.com/compare/skyvern-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/steel-vs-tinyfish.json", "title": "Steel vs TinyFish", "url": "https://www.anchorterminal.com/compare/steel-vs-tinyfish" }, { "json": "https://www.anchorterminal.com/compare/browserbase-vs-tinyfish.json", "title": "Browserbase vs TinyFish", "url": "https://www.anchorterminal.com/compare/browserbase-vs-tinyfish" } ], "panel": null, "scores": [ { "autocua": 25, "by": 35, "edge": "tinyfish", "key": "reliability", "name": "Reliability", "tinyfish": 60, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "autocua": 42, "by": 43, "edge": "tinyfish", "key": "schema", "name": "Schema \u0026 documentation", "tinyfish": 85, "weight": 13 }, { "autocua": 55, "by": 24, "edge": "tinyfish", "key": "ergonomics", "name": "Agent ergonomics", "tinyfish": 79, "weight": 13 }, { "autocua": 38, "by": 22, "edge": "tinyfish", "key": "security", "name": "Security \u0026 auth", "tinyfish": 60, "weight": 14 }, { "autocua": 60, "by": 5, "edge": "autocua", "key": "payments", "name": "Payments \u0026 pricing", "tinyfish": 55, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "autocua": 65, "by": 15, "edge": "tinyfish", "key": "maintenance", "name": "Maintenance \u0026 community", "tinyfish": 80, "weight": 7 }, { "autocua": 42, "by": 17, "edge": "tinyfish", "key": "transparency", "name": "Transparency \u0026 trust", "tinyfish": 59, "weight": 7 } ], "summary": "TinyFish scores 68.2 (B) on agent readiness against AutoCua's 44.3 (E), and leads in 6 of 7 scored categories. AutoCua leads on payments \u0026 pricing. Both do browser automation.", "tasks": null, "tutorials": [], "verdicts": { "autocua": "A capable, fast-moving open-source agent for driving desktops, browsers and phones through real input and accessibility trees, with a careful safety section. It's two weeks old, with no test CI or changelog, and on Windows the model itself decides whether to accept an admin elevation prompt.", "tinyfish": "OpenAPI documents are published for seven APIs, errors carry typed codes and request IDs, and Search and Fetch are free within daily allowances. The terms let Tiny Fish train its models on customer data, run creation takes no idempotency keys, and the status page showed an hour or more of downtime on several days for the Browser and Search APIs." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/autocua-vs-tinyfish", "json": "https://www.anchorterminal.com/compare/autocua-vs-tinyfish.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/autocua-vs-tinyfish.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/autocua-vs-tinyfish.min.md" }, "markdown": "TinyFish scores 68.2 (B) on agent readiness against AutoCua's 44.3 (E), and leads in 6 of 7 scored categories. AutoCua leads on payments \u0026 pricing. Both do browser automation.\n\n- AutoCua: grade E, 44.3/100, rank #1100 of 1354. Markdown https://www.anchorterminal.com/tools/autocua.md · JSON https://www.anchorterminal.com/api/v1/tools/autocua.json\n- TinyFish: grade B, 68.2/100, rank #268 of 1354. Markdown https://www.anchorterminal.com/tools/tinyfish.md · JSON https://www.anchorterminal.com/api/v1/tools/tinyfish.json\n- Best desktop and mobile app automation for AI agents: https://www.anchorterminal.com/best/desktop-automation/index.md\n- All 48 desktop comparisons: https://www.anchorterminal.com/compare/desktop-automation/index.md\n- Best browser automation tools for AI agents: https://www.anchorterminal.com/best/browser/index.md\n- All 230 browser comparisons: https://www.anchorterminal.com/compare/browser/index.md\n\n## Which one, for what\n\n### AutoCua (E)\n\nGood for: Developers who want a local agent to operate desktop apps, their own browser or phones across platforms, on a machine they control.\n\nAhead on:\n- Payments \u0026 pricing, 60 against 55\n\nAlso in its favour:\n- No key needed to call it\n- Open source\n\nWatch for: Two weeks old at version 0.1.9, with no changelog file\n\n### TinyFish (B)\n\nGood for: Agents that want one account for a goal-driven web agent, a raw CDP browser, and free search and fetch.\n\nAhead on:\n- Reliability, 60 against 25\n- Schema \u0026 documentation, 85 against 42\n- Agent ergonomics, 79 against 55\n- Security \u0026 auth, 60 against 38\n- Maintenance \u0026 community, 80 against 65\n- Transparency \u0026 trust, 59 against 42\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n\nWatch for: The terms of 17 August 2026 allow Tiny Fish to train and improve its models on customer data. No opt-out was found in the reviewed pages\n\n\n## Why the edge\n\n### Schema \u0026 documentation: TinyFish +43\n\n- AutoCua (42): Framework reading. No API reference or typed interface beyond run_agent's documented arguments (5 of 25). No llms.txt (0). The README says what each mode drives and where it runs, and agent_capabilities.md lists what it can do (16 of 20). Modes and device are documented strings (6 of 15). Many examples, no documented errors (10 of 15). Tags without a changelog (5 of 15). 5 + 0 + 16 + 6 + 10 + 5 = 42.\n- TinyFish (85): Graded on the REST API. `llms.txt` now links OpenAPI documents for seven APIs (browser, datasets, fetch, main, monitor, research, search). They sit on agent.tinyfish.ai, which we treat as blocked since 1 November, so the counts below are per the 8 October check, not re-read on 1 November, from the main document (28 operations) and the Browser document (3) (25). `llms.txt`, a 531 KB `llms-full.txt`, a Markdown twin of every page and a single page for coding agents (10). All 31 operations read carry a description, several say which endpoint to pick instead, and the MCP tool definitions state when to use and when not to use each tool (17). 189 enums in the main document, ranges such as `max_steps` 1 to 500, and unknown fields rejected. 730 of 1,068 properties carry a description, `goal` is free text by design and the MCP `search` tool takes a JSON-encoded `fetch` string (12). 698 examples in the main document, every operation documents an error response, and an error-code page gives a fix for each code (14). The path is versioned `/v1`. The Pulse changelog still stops at 22 June 2026 and the docs have no API changelog (7). 25+10+17+12+14+7 = 85.\n\n### Reliability: TinyFish +35\n\n- AutoCua (25): Local package. Installs from PyPI as AutoCua with Python 3.10 or later and the supported platforms stated (20). No CI runs the tests; the only workflow, use_case_label.yml, labels issues (0). GitHub issues weren't read, so the open-issue line is scored absent (0). Four tags in a week with no changelog file (5). Version 0.1.9 (0). 20 + 0 + 0 + 5 + 0 = 25.\n- TinyFish (60): Graded as a hosted API. agent.tinyfish.ai/status is the vendor's own page with five components and 90 daily bars each, but no incident write-ups (15 of 20). On 1 November agent.tinyfish.ai answered its robots.txt with a redirect to a sign-in page, which we treat as a blocked host, so the page wasn't re-read. Per the 8 October check, not re-read on 1 November, the Agent API showed no downtime from 11 July to 8 October 2026, the Browser API 420 minutes across six days (120 on 28 September), the Search API 1,500 minutes across seven days (420 on 7 August) and the Fetch API 240 on 27 August. Several outages of an hour or more, so 5 of 30, which is also the value for an unread history, so the unread weeks from 9 October can't move it. Limits are published on the pricing page and in the docs (Search 30 requests a minute and 500 an hour, Fetch 150 URLs a minute, 2 concurrent Agent runs, 5 concurrent Browser sessions) (15). Search and Fetch 429s carry `Retry-After` and `X-RateLimit-*` headers, the docs give backoff guidance and the SDKs retry 429 and 5xx. The Agent pending-run 429 has no `Retry-After` and run creation has no idempotency keys (11). The pricing page lists a 99.99 per cent uptime SLA for Enterprise, with no SLA document found (5). Browser, Search and MCP were declared generally available in June 2026 and the API is `/v1`. The SDKs are 0.x and `max_steps` is still beta-gated (9). 15+5+15+11+5+9 = 60.\n\n### Agent ergonomics: TinyFish +24\n\n- AutoCua (55): Framework reading. One call with a mode, provider, model and task runs a whole agent (20 of 25). A separate compression agent splices handoff summaries in, and runs are capped and stoppable (15 of 20). Permission and blocked-input errors are reported specifically, with no error reference (8 of 20). No resume or retry semantics described (2 of 20). Sensible defaults (simulators unless device is set), Python only (10 of 15). 20 + 15 + 8 + 2 + 10 = 55.\n- TinyFish (79): Fetch takes an output format, include and exclude selectors, a cache age and a per-URL timeout, and run reads choose whether screenshots come back as URLs or inline. The MCP docs page now lists 35 tools, among them dataset, monitor and research tools, and the proxy repository's reference (28 September) lists 28 (18). Run lists take a cursor, a limit of 1 to 100 and filters for status, goal text, dates and an `owner` of `me` or `team`, and Search pages from 0 to 10 (18). Errors carry a code, a message, optional `details` and a `request_id`, and wallet denials add `non_retryable` and balance fields (19). The docs still say run creation doesn't support idempotency keys and a retry may create duplicate runs. Cancels, research cancels and session deletes are idempotent and a replayed wallet top-up is credited once. We couldn't read MCP annotations without signing in (9). A run needs only `url` and `goal`, a browser session needs nothing, and there are official Python and TypeScript SDKs and a CLI (15). 18+18+19+9+15 = 79.\n\n### Security \u0026 auth: TinyFish +22\n\n- AutoCua (38): Framework reading (telemetry, approvals, guardrails, sandboxing). Provider keys stored in a local folder with Chrome profiles (10 of 30). The worker tools are an allow-list with no write tool, unseen ids are refused, downloads need a yes, but on Windows the model answers UAC elevation prompts itself through a kernel driver, with no person asked (6 of 20). The scraping ruleset has a prompt-injection instruction to log page text that gives instructions (10 of 15). Runs are logged in the app, with no audit log (7 of 15). No security policy, disclosure route or advisories found (5 of 20, for the vault and certificate handling). 10 + 6 + 10 + 7 + 5 = 38.\n- TinyFish (60): REST calls take an `X-API-Key` header. Keys are created and deleted in the dashboard and shown once, with no scopes found. Contract organisations add personal and workflow keys that admins can revoke, which separate ownership but not permissions. MCP uses OAuth 2.1, and run IDs are separated between CLI or REST tokens and MCP tokens (21). Vault credentials are opt-in per run with `use_vault` and can be limited with `credential_item_ids`, and the docs say the agent never sees passwords. Organisation workflow keys can't use vault credentials or profiles, and admins can set a spend cap that stops usage. No read-only key or approval step for agent actions was found, and `max_steps` is beta-gated (9). Pages are untrusted content. The plugin page mentions safety rules for untrusted content, and the Fireworks integration guide now tells callers to treat Search results as untrusted because they can contain prompt injection, with a system prompt that says never to follow instructions in them. The Agent and Browser docs carry no such guidance (6). Each run keeps per-step screenshots and optional HTML snapshots, usage lists exist for Search, Fetch and Browser sessions, and audit logs are listed under Enterprise (11). security.txt is valid until 1 September 2027, and the disclosure policy v1.1 of 15 September 2026 has safe harbour and discretionary rewards with no formal bounty. The terms and the pricing page cite ISO 27001, and the trust centre that would show it is drawn by script and was unread (13). 21+9+6+11+13 = 60.\n\n### Transparency \u0026 trust: TinyFish +17\n\n- AutoCua (42): MIT (30). Says it sends data only to the chosen model provider and keeps everything else locally, and the source agrees (20 of 30). No deprecation policy (0). States no telemetry, and none was found (20). 30 + 20 + 0 + 20 = 70.\n- TinyFish (59): The platform is closed with published terms, effective 17 August 2026. The MCP proxy and cookbook are MIT, and the SDK packages state no licence in npm or PyPI metadata (14). The terms allow Tiny Fish to review runs and to train and improve its models on customer data, which is stated plainly. The privacy policy of 14 December 2025 gives no retention periods and names TinyFish Inc. in Cupertino, while the terms name Tiny Fish, Inc. in Los Altos. No public DPA was found (10). No deprecation policy was found. The docs flag two parameters as deprecated without dates, and the terms give 30 days' notice of material changes to the terms (5). No subprocessor list or hosting location was found on readable pages. The enterprise page says data residency is agreed by contract, and the trust centre was unread (3). 14+10+5+3 = 32.\n\n### Maintenance \u0026 community: TinyFish +15\n\n- AutoCua (65): v0.1.9 tagged on 4 November 2026 (30). Four tags in 90 days (20). Issues and pull requests weren't read (0 of 25). The PyPI wheel is current (15). No CI; dependencies pinned per OS in requirements files (0 of 10). 30 + 20 + 0 + 15 + 0 = 65.\n- TinyFish (80): `tinyfish` 0.11.0 was published to PyPI on 24 October 2026 and 0.10.0 on 21 October, per PyPI's release feed (30). Eight Python SDK releases since 3 August (0.5.0 on 4 August to 0.11.0), counted half as SDK tags, still more than three (20). npm couldn't be read on 1 November, so the TypeScript SDK and CLI dates rest on the 8 October check (`@tiny-fish/cli` 0.48.1 on 7 October, `@tiny-fish/sdk` 0.8.0 on 29 September). The Pulse changelog still stops at 22 June 2026. Support is by e-mail and Discord, and the public MCP proxy repository has commits to 31 October. We didn't read issue reply times (8 of 15 on the closed-service line). The hosted MCP server is in the official MCP registry as `ai.tinyfish.agent/web-agent`, version 1.0.1, published 17 February 2026, and both SDKs are current (15). The MCP proxy repository runs CI, Renovate, and OSV and secrets scanners, cleared 11 OSV dependency findings on 6 October, and publishes through npm trusted publishing. The SDK packages name no source repository (7). 30+20+8+15+7 = 80.\n\n## Score by category\n\n| Category | Weight | AutoCua | TinyFish | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 25 | 60 | TinyFish +35 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 42 | 85 | TinyFish +43 |\n| Agent ergonomics | 13% (16.2 this run) | 55 | 79 | TinyFish +24 |\n| Security \u0026 auth | 14% (17.5 this run) | 38 | 60 | TinyFish +22 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 55 | AutoCua +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 65 | 80 | TinyFish +15 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 42 | 59 | TinyFish +17 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **44.3 · E** | **68.2 · B** | |\n\n## Facts side by side\n\n| Fact | AutoCua | TinyFish |\n| --- | --- | --- |\n| Kind | Agent framework | HTTP API |\n| Vendor | Ashish Yadav and contributors (ComputerUseAgent on GitHub) | TinyFish |\n| Hosted endpoint | no (local only) | `https://agent.tinyfish.ai` |\n| Transports | | HTTP |\n| Auth | None | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | Proprietary service under Tiny Fish's terms of service. The MCP proxy `@tiny-fish/mcp` and the cookbook are MIT. The SDK packages state no licence in npm or PyPI metadata |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| MCP registry | not listed | `ai.tinyfish.agent/web-agent` |\n| Last release | 2026-11-04 | 2026-10-24 |\n| Terms last updated | no document linked | 2026-08-17 |\n| Privacy policy last updated | no document linked | 2025-12-14 |\n| Customer content may train models | not read yet | yes |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | none | 5.7k npm/wk, 6.5k PyPI/wk |\n| Agent reviews | none | 2.8/5 (4) |\n\n## How the scores have moved\n\n### AutoCua\n\nNo score change since it was listed.\n\n### TinyFish\n\n- +0.5 on 1 November 2026: new evidence\n- -0.1 on 28 October 2026: correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**AutoCua.** A capable, fast-moving open-source agent for driving desktops, browsers and phones through real input and accessibility trees, with a careful safety section. It's two weeks old, with no test CI or changelog, and on Windows the model itself decides whether to accept an admin elevation prompt.\n\n**TinyFish.** OpenAPI documents are published for seven APIs, errors carry typed codes and request IDs, and Search and Fetch are free within daily allowances. The terms let Tiny Fish train its models on customer data, run creation takes no idempotency keys, and the status page showed an hour or more of downtime on several days for the Browser and Search APIs.\n\n## Before you call either\n\n### AutoCua\n\n1. pip install AutoCua, then call run_agent with a mode such as \"web use\" or \"computer use\", a provider, a model and a task\n2. Run it on a machine or account you can afford to lose; it drives real input and keeps logged-in browser profiles\n3. On Windows, don't install the Interception driver unless you accept the model deciding UAC prompts\n4. Set AutoCua_DATA_DIR to keep keys and profiles somewhere private\n5. Phones go over USB from a script; Wi-Fi only through the desktop app\n\n### TinyFish\n\n1. Check `result` as well as `status`. A run can be `COMPLETED` while the goal failed, with `result.status` set to `failure`\n2. Don't retry `POST /v1/automation/run` blindly after a timeout. There are no idempotency keys, so list runs first to avoid duplicates\n3. Use `/v1/automation/run-async` or `/run-sse` when a run may need cancelling. Runs started with the synchronous endpoint can't be cancelled\n4. Allow 60 seconds for Browser session creation, connect Playwright to `cdp_url` (not `base_url`), and `DELETE` the session when done because billing is per minute\n5. Never put passwords in `goal`, which is logged. Pass `use_vault: true` with `credential_item_ids`, or `use_profile: true` for saved login state\n\n## Questions\n\n### Which is better for AI agents, AutoCua or TinyFish?\n\nTinyFish scores 68.2 (B) on agent readiness against AutoCua's 44.3 (E), and leads in 6 of 7 scored categories. AutoCua leads on payments \u0026 pricing.\n\n### Can an agent call AutoCua and TinyFish without installing anything?\n\nNo hosted endpoint is listed for AutoCua. TinyFish has a hosted endpoint at https://agent.tinyfish.ai.\n\n### Are AutoCua and TinyFish open source?\n\nAutoCua is open source (MIT). No open-source release is listed for TinyFish.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/autocua-vs-tinyfish.json, and with the fewest tokens: https://www.anchorterminal.com/compare/autocua-vs-tinyfish.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"autocua\", \"b\": \"tinyfish\"}`. From a terminal: `anchor compare autocua tinyfish`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/autocua.json and https://www.anchorterminal.com/api/v1/tools/tinyfish.json\n\n## Other comparisons with AutoCua or TinyFish\n\n- [agent-browser vs AutoCua](https://www.anchorterminal.com/compare/agent-browser-vs-autocua.md)\n- [agent-browser vs TinyFish](https://www.anchorterminal.com/compare/agent-browser-vs-tinyfish.md)\n- [Airtop vs AutoCua](https://www.anchorterminal.com/compare/airtop-vs-autocua.md)\n- [Airtop vs TinyFish](https://www.anchorterminal.com/compare/airtop-vs-tinyfish.md)\n- [Anchor Browser vs AutoCua](https://www.anchorterminal.com/compare/anchor-browser-vs-autocua.md)\n- [Anchor Browser vs TinyFish](https://www.anchorterminal.com/compare/anchor-browser-vs-tinyfish.md)\n- [AutoCua vs Browser Use](https://www.anchorterminal.com/compare/autocua-vs-browser-use.md)\n- [AutoCua vs Browserless](https://www.anchorterminal.com/compare/autocua-vs-browserless.md)\n- [AutoCua vs BxPlaywright](https://www.anchorterminal.com/compare/autocua-vs-bx-playwright.md)\n- [AutoCua vs Chrome DevTools MCP](https://www.anchorterminal.com/compare/autocua-vs-chrome-devtools-mcp.md)\n- [AutoCua vs Functionize MCP server](https://www.anchorterminal.com/compare/autocua-vs-functionize-mcp.md)\n- [AutoCua vs Hyperbrowser](https://www.anchorterminal.com/compare/autocua-vs-hyperbrowser.md)\n- [AutoCua vs Kane CLI](https://www.anchorterminal.com/compare/autocua-vs-kane-cli.md)\n- [AutoCua vs Lightpanda](https://www.anchorterminal.com/compare/autocua-vs-lightpanda.md)\n- [AutoCua vs Notte](https://www.anchorterminal.com/compare/autocua-vs-notte.md)\n- [AutoCua vs Playwright MCP](https://www.anchorterminal.com/compare/autocua-vs-playwright-mcp.md)\n- [AutoCua vs Pomerado](https://www.anchorterminal.com/compare/autocua-vs-pomerado.md)\n- [AutoCua vs Puppeteer](https://www.anchorterminal.com/compare/autocua-vs-puppeteer.md)\n- [AutoCua vs Puppeteer (archived MCP reference server)](https://www.anchorterminal.com/compare/autocua-vs-puppeteer-reference-server-archived.md)\n- [AutoCua vs Robocorp](https://www.anchorterminal.com/compare/autocua-vs-robocorp.md)\n- [AutoCua vs Selenium](https://www.anchorterminal.com/compare/autocua-vs-selenium.md)\n- [AutoCua vs Skyvern](https://www.anchorterminal.com/compare/autocua-vs-skyvern.md)\n- [AutoCua vs Steel](https://www.anchorterminal.com/compare/autocua-vs-steel.md)\n- [Browser Use vs TinyFish](https://www.anchorterminal.com/compare/browser-use-vs-tinyfish.md)\n- [Browserless vs TinyFish](https://www.anchorterminal.com/compare/browserless-vs-tinyfish.md)\n- [BxPlaywright vs TinyFish](https://www.anchorterminal.com/compare/bx-playwright-vs-tinyfish.md)\n- [Chrome DevTools MCP vs TinyFish](https://www.anchorterminal.com/compare/chrome-devtools-mcp-vs-tinyfish.md)\n- [Functionize MCP server vs TinyFish](https://www.anchorterminal.com/compare/functionize-mcp-vs-tinyfish.md)\n- [Hyperbrowser vs TinyFish](https://www.anchorterminal.com/compare/hyperbrowser-vs-tinyfish.md)\n- [Kane CLI vs TinyFish](https://www.anchorterminal.com/compare/kane-cli-vs-tinyfish.md)\n- [Lightpanda vs TinyFish](https://www.anchorterminal.com/compare/lightpanda-vs-tinyfish.md)\n- [Notte vs TinyFish](https://www.anchorterminal.com/compare/notte-vs-tinyfish.md)\n- [Playwright MCP vs TinyFish](https://www.anchorterminal.com/compare/playwright-mcp-vs-tinyfish.md)\n- [Pomerado vs TinyFish](https://www.anchorterminal.com/compare/pomerado-vs-tinyfish.md)\n- [Puppeteer (archived MCP reference server) vs TinyFish](https://www.anchorterminal.com/compare/puppeteer-reference-server-archived-vs-tinyfish.md)\n- [Puppeteer vs TinyFish](https://www.anchorterminal.com/compare/puppeteer-vs-tinyfish.md)\n- [Selenium vs TinyFish](https://www.anchorterminal.com/compare/selenium-vs-tinyfish.md)\n- [Skyvern vs TinyFish](https://www.anchorterminal.com/compare/skyvern-vs-tinyfish.md)\n- [Steel vs TinyFish](https://www.anchorterminal.com/compare/steel-vs-tinyfish.md)\n- [Browserbase vs TinyFish](https://www.anchorterminal.com/compare/browserbase-vs-tinyfish.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-06", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AutoCua vs TinyFish", "url": "" } ], "description": "TinyFish scores 68.2 (B) to AutoCua's 44.3 (E) for browser automation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AutoCua E 44.3", "TinyFish B 68.2", "scores" ], "h1": "AutoCua vs TinyFish", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/autocua-vs-tinyfish", "published": "2026-10-01", "section": "tools", "title": "AutoCua vs TinyFish for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/autocua-vs-tinyfish" }, "tokens": { "markdown": 5400, "slim": 3180 }, "version": 1 }