BrowserAct vs Context.dev

BrowserAct 23

Hosted reading. No status page found (0) and no readable incident history (5). The docs say there are no rate limits, and give concurrency by plan (2 free, up to 20 for paid API users) and a 7-hour task cap (8). No 429 or retry guidance, and no idempotency keys on task creation (0). No SLA (0). No beta label on the API or MCP server (10). 0 + 5 + 8 + 0 + 0 + 10 = 23.

Context.dev 67

Better Stack status page at status.context.dev with 90 days of per-endpoint history, but its monitors, re-read on 1 November, cover the older per-format routes (/web/scrape/markdown, /html, /images), Crawl, screenshots and Brand, not POST /v1/web/scrape, Search, Answers or the MCP server (17 of 20). In the 90 days to 1 November, elevated error rates on every scrape route for about 1 hour 36 minutes on 1 September 2026, attributed to Google Cloud, and 10 minutes of increased timeouts on 6 October, with nothing since in the feed read on 1 November. One major (10). Concurrency per plan from 2 on Free to 500 on Scale and Scale 2.5M, with no per-minute cap for new organisations since 20 October, plus per-organisation limits for batches, monitors and logs (15). 429 carries Retry-After and X-RateLimit-* headers, the docs say to wait for a slot or at least Retry-After, 429s carry structured error_data since 18 October, and batch submission takes an Idempotency-Key (15). A 99.9% uptime SLA is listed only for Enterprise, with no terms published (0). The API is generally available (10). 17 + 10 + 15 + 15 + 0 + 10 = 67.

BrowserAct 41

One account-wide API key type, revocable and listed with last-used time, but without scopes or expiry (18). Confirmation Required mode holds purchases and asset creation or deletion for approval in the BrowserAct page (14). Scraped pages are untrusted, and no prompt-injection guidance was found (3). Keys show last use and runs keep logs (6). No security page, disclosure policy, certification or bug bounty found (0). 18 + 14 + 3 + 6 + 0 = 41.

Context.dev 83

Restricted keys scoped to data calls, logs, monitors, batches and, since 28 October, access policies on every plan, revocable, with a documented rotation process, and OAuth with PKCE on the MCP server. The docs say never to put a key in a URL and no query-string option was found (30). Read-only scopes for logs, monitors and batches, and the MCP guide, re-read on 1 November, asks clients to keep approvals on for tools that start work or change state. Access policies (28 October) can limit which domains requests reach, per key or account, but are enabled per organisation on request. MCP tool annotations couldn't be checked (15 of 20). The MCP guide, agent quickstart and agent-context guide say to treat page content as untrusted data that can't authorise tool calls. No filter or classifier found (10 of 15). Request logs with retained input and response for up to a year, a Logs API, per-key usage and X-Credits-Used (15). SOC 2 Type II since 18 September 2026 per the changelog, and the trust centre on 1 November shows SOC 2 Type 2 and Type 1 as compliant, and a valid security.txt to 26 September 2027 that points to the support address. No disclosure policy or bug bounty found (13 of 20). 30 + 15 + 10 + 15 + 13 = 83.

BrowserAct 49

Graded on the API, since the MCP tool list isn't published. Task results come back whole, with no field selection found (10). Lists of bots, templates and tasks are paginated (15). Errors carry numeric codes with documented meanings for a few cases (12). No idempotency key on task creation; webhooks and a status endpoint avoid polling loops (5). No official SDK in two languages; the CLI is Python (7). 10 + 15 + 12 + 5 + 7 = 49.

Context.dev 90

formats selects outputs, and mainContentOnly, include and exclude selectors and Highlights with maxCharacters shrink responses. The MCP server registers 42 tools by the vendor's count with no toolsets found, and caps responses at 40,000 characters with a truncation flag, re-read on 1 November (20 of 25). Map and Crawl filter by path, subdomain, count and, since 19 October, an exclude pattern, crawls take page, depth and time limits, and logs, batches, news and People Search paginate (20). Every failed output returns an error_code and a message with the next step, 403 names the missing permission, and since 18 October credit exhaustion returns 402 with error_data saying how to refill (20). Batch submission is idempotent, reads are safe to retry and unbilled on 408, 429 and 5xx. MCP readOnly and destructive hints couldn't be checked (15 of 20). Two required fields, and SDKs in five languages (15). 20 + 20 + 20 + 15 + 15 = 90.

BrowserAct 44

Closed service with published terms naming the operating company and governing law (15). The privacy policy of 15 May 2025 states retention by category and that crawled data is kept per plan and deletable by the user (15). No deprecation policy or notices found (0). No sub-processors or data locations named (3). 15 + 15 + 0 + 3 = 33.

Context.dev 78

Closed service. SDKs and CLI are Apache-2.0, the MCP server is closed. Terms last updated 26 October 2026 under Delaware law now say automated access is expected, that software calling the API is never by itself a violation, and that benchmarking is allowed, so the bar on bots and scripts that cost 2 points on 17 October is gone (15 of 30, up from 13). Privacy policy (31 October 2026) and terms agree that requests and results may be used to train models unless a request uses zero data retention or another agreement applies. The docs keep request logs up to a year and batch results 180 days, the DPA (29 October 2026) returns or deletes data within 10 business days of the end of service, but the privacy policy keeps API request logs as long as needed and gives no fixed periods (18 of 30). A stated 90-day minimum for deprecated surfaces and dated changelog notices (20). The website sub-processor list, last updated 31 October 2026, names 15 with each location and purpose and promises 14 days' notice of changes, and it now agrees with the trust centre, which also lists 15 and names Cloudflare among them, where on 17 October the two lists disagreed (20, up from 14). 15 + 18 + 20 + 20 = 73.

BrowserAct 25

No x402, MPP or L402 (0). Plan prices and credit costs per bot build, run and workflow step are public, but there is no direct per-call price (15). A free plan with 200 credits; whether it needs a card isn't stated (10). A person signs up and creates the key in the dashboard (0). 0 + 15 + 10 + 0 = 25.

Context.dev 50

No x402, MPP or L402 in llms.txt, the pricing page or the OpenAPI file on 1 November (0). Credit costs per operation and overage per 1,000 credits are public (20). Free plan of 1,000 credits a month, "no credit card required" (20). auth.md, re-read on 1 November, lets an agent start registration and poll for a key, but the person completes the claim in a browser, and the docs MCP route also needs a browser sign-in (10 of 20). 0 + 20 + 20 + 10 = 50.

BrowserAct 61

browser-act-cli 1.6.2 on 5 November 2026, read from PyPI's release feed (30). Six CLI releases from 15 October to 5 November (20). A closed service with a support address, but no public changelog or issue tracker found (8). No official SDKs and no entry in the official MCP registry (0). The CLI package carries no licence or repository in its metadata (3). 30 + 20 + 8 + 0 + 3 = 61.

Context.dev 85

TypeScript SDK 3.21.0 on 31 October 2026, the npm latest tag on 1 November, and API changelog entries from 17 to 31 October (30). 19 TypeScript SDK releases from 3.9.0 on 18 October to 3.21.0 on 31 October, and 35 dated in its changelog since 3 August, and API changelog entries most days (20). Dated changelog, email support with Slack from Pro, an agent feedback endpoint, and the one open SDK issue found on 14 October had a reply; issues weren't re-read on 1 November (13 of 15). Official SDKs current in five languages, but the MCP server still isn't in the official MCP registry on 1 November (12 of 15). SDK repositories run CI and release-please (10). 30 + 20 + 13 + 12 + 10 = 85.