Browser Use vs Pomerado

Browser Use

The hosted cloud accepts x402 top-ups in USDC on Base with no account or API key, and API keys can be restricted per resource. x402 doesn't cover API V4, the API the docs recommend, the privacy policy says inputs are used to train Browser Use's models, and no prompt-injection guidance was found in the docs.

Pomerado

An agent can find and run 46 public read-only website tools with no account, and signed-in calls get scoped, expiring keys, idempotency keys and a documented code for every failure. Pomerado is 12 days old, with no status page or security.txt, and its homepage lists bank and government portals that its builds refuse.

Browser Use

1. Send the key as X-Browser-Use-API-Key with no Bearer prefix on the REST API, where a Bearer header returns 401. The MCP server takes Authorization: Bearer
2. Stop browsers with PATCH /api/v4/browsers/{id} and {"action":"stop"}. Closing CDP or the SDK client leaves the browser billing
3. Poll GET /runs/{id}/status, not the full run, and wait for the returned Retry-After on 429, which can be 300 seconds at the edge
4. Before resubmitting after a timeout, read the existing run's status. The server keeps running and may already have submitted a form
5. With a wallet and no key, call x402.api.browser-use.com on /api/v2 or /api/v3 routes, since x402 doesn't take V4 yet. A task stops with INSUFFICIENT_CREDITS if credit runs out

Pomerado

1. Try public read-only tools at https://mcp.pomerado.ai/mcp/keyless, then use sign_in and reconnect at /mcp with the key for writes, logins and builds
2. Call find_website_tool with a query and site_url, and check possible_matches before starting a build
3. Send an idempotency_key with every run that writes, and on outcome_unknown read the website back before calling again
4. Give the person the job's answer_url for website logins and codes. Don't take passwords in chat
5. Save a run's result when it arrives. It is returned once and erased after 60 minutes if unread