Browserless vs Kernel

Browserless 82

Graded as a hosted service, on the cloud API and its hosted MCP server. status.browserless.io runs on Better Stack with eight monitored components and 90 days of daily history (20). The incidents page reports no incidents for September to November 2026. Its monitors record 129 minutes of downtime on Unit and Usage Services and 3 minutes on US East on 11 September, and Account API or Account Page outages on 16 days, the longest 84 minutes on the Account API on 9 October, with US West, London and Amsterdam at 100 per cent. None takes down a browser region, so minor only (20). Concurrency and session-length limits are published per plan, 2 to 100 browsers and 2 to 60 minutes, and the docs say there is no hourly or daily unit limit (15). 429 is documented as a full concurrency slot or queue, with a retry and exponential backoff guide and advice to retry only operations that are safe to run twice. No Retry-After header or idempotency key was found in the reviewed documentation (12). One docs page claims a 99.9% uptime SLA and the site lists SLAs under Enterprise, but no SLA terms are published (5). The REST, WebSocket and MCP surfaces are generally available, with the MCP server at 1.42.0 (10).

Kernel 53

Hosted reading. status.kernel.sh on incident.io with a public incident feed (20). In the 90 days from 8 August it lists browser connection failures on 10 September (54 minutes, major), frozen popups on 1 October (71 minutes, major), elevated API errors on 19 October (4 minutes, critical), proxy failures on 23 October (65 minutes, major) and browser creation errors on 4 November (29 minutes, major), plus minor ones. Several majors, two of them an hour or more (0). Rate limits are per organisation with headers on every response, and concurrency is published per plan, but the create-rate numbers aren't (8). 429 with Retry-After, SDK retries with a typed error, safe retry with the same MPP credential and 409 on concurrent pool changes (15). The terms mention service levels in an order form but no public SLA was found (0). The API and MCP server carry no beta label (10). 20 + 0 + 8 + 15 + 0 + 10 = 53.

Browserless 53

An account holds up to 20 named API tokens, each shown once and revocable on its own, with a rotation guide. The hosted MCP server also accepts OAuth sign-in with PKCE. Cloud tokens have no scopes, and token roles apply only to self-hosted Enterprise containers (22). The docs give ?token= in the URL as the standard way to authenticate REST and WebSocket calls and as an option for MCP, a secret in a query string (minus 10). The connector endpoint limits an assistant to five tools, account tools are read-only, the agent prompt tells the model to confirm controls marked destructive, and the draft Stripe Link checkout needs the buyer's approval for each purchase up to $50. No read-only token (10). Pages are untrusted content. Saved logins and card details are kept out of the model's context, but no prompt-injection guidance was found in the docs or the MCP agent prompt (3). Request logs record every request with endpoint, region, duration, error and cost, filterable by API key, and sessions can be replayed (13). SOC 2 Type II, third-party penetration tests and a disclosure policy with a 72-hour acknowledgement target on the trust centre. No security.txt and no bug bounty found (15).

Kernel 81

Scoped API keys with resource and action policies, project scoping and expiry, and OAuth 2.1 for MCP with project-limited tokens (30). Least privilege through scoped keys, a payment cap for cards through the MCP server and vault writes that need their own action (16). Pages an agent browses are untrusted, and we found no prompt-injection guidance in the docs read (4). Audit log search and export on Start-Up and above (13). SOC 2 Type II, HIPAA, PCI DSS and ISO 27001 on the security page and a HackerOne bounty (18). 30 + 16 + 4 + 13 + 18 = 81, before the deduction for the November 2026 incident.

Browserless 40

No x402, MPP or L402 on any endpoint. The Stripe Link checkout tools let an agent pay a merchant and are not a way to pay Browserless (0). Plan prices, included units and per-unit overage rates of $0.0015 to $0.0020 are published without login, with the unit defined as up to 30 seconds of browser time (20). Free plan with 1,000 units a month, and the pricing page says no card is required (20). A person has to sign up in a browser to get a token or complete OAuth (0).

Kernel 65

MPP on POST /mpp/browsers, a 402 challenge paid with a Stripe shared payment token through Link, covering one browser product only, not the API or MCP server (20). Per-second prices public without a login (20). The Developer plan is free with $5 of monthly credit, but whether signup needs a card wasn't stated on the pages read (10). Through MPP an agent gets a browser with no account or key, though a person approves each Link payment (15). 20 + 20 + 10 + 15 = 65.

Browserless 78

The full MCP server documents 14 tools (15), and a separate connector endpoint exposes five read-only tools. The browserless_agent description is long, so we added back 5 of a possible 10 (20). browserless_logs pages by cursor, search, crawl and profiles take limit, crawl output is truncated per page, and Smart Scrape returns only the formats asked for (17). Errors come with a documented table of causes and fixes, a requestId that can be looked up in request logs, and x-response-code headers for the target site's status (16). Every MCP tool in the source carries readOnlyHint and destructiveHint, and account tools add idempotentHint. No idempotency keys, and the docs warn that a retried mutation can repeat a click or form submission (15). Few required parameters and existing Puppeteer or Playwright scripts connect by changing the endpoint, but the only published SDK is TypeScript. The docs say the Python SDK is not on PyPI yet (10).

Kernel 84

Graded mainly on the API, with the MCP server noted. Responses are scoped per resource and the MCP server groups actions into about 32 tools (18). List endpoints page with limit and offset and filter by status (18). Typed SDK errors and documented 409 on concurrent changes, 204 on a pool timeout and 429 (17). Retrying an MPP purchase with the same credential returns the same browser, and the MCP tools carry readOnlyHint where read-only (16). SDKs in TypeScript, Python and Go plus a CLI, with defaults such as a 60-second timeout (15). 18 + 18 + 17 + 16 + 15 = 84.

Browserless 85

@browserless.io/mcp 1.42.0 was tagged on 29 October 2026 and the core server 2.58.1 on 30 October (30). The repositories hold 33 MCP and 16 core release tags dated in the 90 days from 3 August, and the product changelog has an entry for October 2026 (20). Both repositories show commits on 30 October 2026 and use release automation. GitHub's pages and API refused our requests, so issue reply times went unread, and we scored the public changelogs and the support email only (12). Since 16 October the MCP server is in the official MCP registry under the verified namespace io.browserless/mcp, with 1.42.0 as its latest entry (15). Test, lint, CodeQL and dependency-update workflows are in the repositories. We did not read their run results (8).

Kernel 90

The changelog's latest entry is 16 October 2026 and the MCP server repository has commits on 6 November (30). More than three dated changes in 90 days, scoped keys, memory tiers, GPU tier and card payments among them (20). A closed service with a public changelog, Discord, email support and an open-source MCP server with 210 commits since 8 August (15). Official SDKs in three languages, and the MCP server in the registry as com.onkernel/kernel-mcp-server 1.1.0 (15). CI and tests in the MCP repository (10). 30 + 20 + 15 + 15 + 10 = 90.