BxPlaywright vs Kane CLI

BxPlaywright 60

Free, self-hosted, nothing to buy, so 20 + 20 + 20. The BoxLang runtime's paid plans aren't needed for this module. No payment protocol (0). 60 in all.

Kane CLI 20

No x402, MPP or L402 (0). Plan prices are public per the listing check of 1 November 2026 (Starter $17 a month billed annually, Pro $89), and run_end reports credits per run, but the credit price per run isn't published, so plan-only pricing (10). The release says "free to start" and the check found a 10,000-credit, 30-day trial; whether it needs a card couldn't be read today. Judgement call (10 of 20). A person signs up and approves OAuth in a browser, or copies an access key from the dashboard, before any run (0).

BxPlaywright 70

Apache-2.0, OSI approved, in box.json and src/main/resources/LICENSE (30). Local software with no data statement for the module. The source contacts only nodejs.org, Playwright's browser downloads and the pages it is told to open, and Ortus's privacy policy covers its website and customers (15 of 30). The integrations page says a minor release only adds and removals wait for a major release, listed in the changelog. Nothing has been released under it, and the module was renamed from playwright to bxplaywright on 12 October before any release (10 of 20). No telemetry found in the source and no statement either way in the docs, scored as boxlang-ai was (10 of 20). 30+15+10+10 = 65.

Kane CLI 38

The editorial half. The wrapper, skill and docs are Apache-2.0. The runner, assurance and pinned Node binaries are labelled Apache-2.0 on npm with no source in the linked repository, and the service terms couldn't be read (12 of 30). The repository says what leaves the machine. Every run uploads to Test Manager with screenshots and an evidence pack recording the user's name and email, secrets are masked, credentials are stored with mode 0600, and the evidence viewer reads packs locally. The privacy policy, DPA and retention periods are on testmuai.com and weren't read (10 of 30). The changelog calls out breaking changes, such as the removal of the bare-objective shortcut in 0.4.1, but there's no deprecation policy or dated notice period (5 of 20). The changelog describes telemetry (a remote log, support ids, errors spooled and sent at exit) and a daily npm update check. The opt-out KANE_TELEMETRY=0 appears only in a skill reference, not the user guide (8 of 20).

BxPlaywright 53

The snapshot build of 23 October 2026 is the latest published package, so 30 on time, though it isn't a release (30). No tagged releases or dated changelog entries in the 90 days, only one version rebuilt (0 of 20). 39 pull requests merged by Luis Majano between 30 September and 23 October. Issue replies couldn't be read and bugs go to Jira (10 of 25). Not in the official MCP registry, and the ForgeBox package has no stable version (5 of 15). Playwright for Java 1.63.0, Dependabot for Gradle monthly and Actions quarterly, a daily test run and a format check (8 of 10). 30+0+10+5+8 = 53.

Kane CLI 77

0.10.0 on npm on 28 October 2026, 4 days ago (30). 28 releases from 3 August to 1 November 2026, 0.8.4 to 0.10.0, each in the changelog (20). The repository has 337 commits, pull requests up to #222 merged within days by LambdaTest staff, a Discord and an issue tracker. GitHub's API wasn't reachable from this session, so open issues and reply times weren't counted (12 of 25). Not an MCP server. The CLI and skill are current on npm and a Homebrew tap, with no SDK (10 of 15). CI runs the skill installer's tests on Linux, macOS and Windows with Node 18 and 22. The CLI's own source and tests aren't public, and the main package carries no npm provenance attestation while the skill package does (5 of 10). Kane CLI is six and a half months old by its first npm release.

BxPlaywright 43

Library reading, as puppeteer and playwright-mcp were. No credential to leak and nothing to scope, so the middle band (20 of 30). Nothing is restricted by default. browser_visit takes any URL with no allow-list, browser_screenshot writes to any path the model passes, and the tools are added to bx-ai's global registry unless registerAiTools is false, so an agent given every registered tool gets a browser. Over MCP it starts Microsoft's server, which limits file access to workspace roots, and Ortus's plugin starts it with --headless but without --isolated, with browser_run_code_unsafe and browser_evaluate in the default set. HTTPS errors are not ignored by default (6 of 20). Page snapshots and text go to the model unfenced, and the docs give no prompt-injection guidance (0 of 15). Screenshot, trace and video policies, show-trace, and interception points such as onPageCreate and onPlaywrightArtifact give the operator a record, all off by default (10 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel; SECURITY.md points there. No security.txt (410, per the boxlang-ai check of the same day), no bounty, no advisories. Node.js downloads are checked against the release's SHA-256 list (7 of 20). 20+6+0+10+7 = 43.

Kane CLI 55

Two credential routes. OAuth with browser consent and token revocation on logout, scopes not documented; or the account's username and access key, which the docs say lets anyone holding it run tests on the account, passed as a command-line flag in CI. Not in a URL. 20 of 30 for revocable credentials without documented scopes. Exploration's read_only policy blocks write requests to any host and never presses Delete, Sign out or Pay, with --deny, --allow-domain and --allow-post, and the first mutating run in a project asks once on a terminal. The default is mutating, with no confirmation in agent mode (12 of 20). Results include text from the page under test. The 0.10.0 content fence masks secrets before they leave the worker, but no prompt-injection guidance was found (2 of 15). Every run lands in Test Manager with screenshots, evidence packs record steps and logs, and Exploration findings keep a history naming who changed what (13 of 15). SECURITY.md with security@testmuai.com, signed and notarised binaries per the README, npm registry signatures. No bug bounty, certification or security.txt could be checked, since testmuai.com wasn't readable, and SECURITY.md's supported versions list only 0.1.x (8 of 20).

BxPlaywright 66

Library reading. BoxLang is dynamically typed. The public API is listed in the docs' integrations page, help() and bxplaywright help --json describe it at run time, and the ten agent tools describe each argument in a sentence, with no published API reference (14 of 25). llms.txt with a Markdown copy of each of 18 docs pages (10). The AI page says when to use aiTools(), the registry or MCP, and when to turn registration off. Tool descriptions are one line each (13 of 20). Every agent-tool argument is a string, with no enums or limits; library options are checked, and InvalidOption lists the valid values (9 of 15). An errors page lists each error type with when it happens and the fix, eight runnable examples sit in the repository, and the docs have code on every page (13 of 15). Keep a Changelog and docs versioning on release, but no released version and no tags yet (7 of 15). 14+10+13+9+13+7 = 66.

Kane CLI 77

No OpenAPI or JSON Schema file. The NDJSON events are documented in typed Markdown tables, run_end is declared stable across versions, and each command family has its event list (10 of 25). Markdown docs in the repository, an agent skill and a context7.json for agents. The agents.md guide on testmuai.com wasn't readable and no llms.txt was checked (10). The user guide and skill say when to use run, testmd, testrun, assurance or Exploration, and when not (Exploration when there are no written requirements, read_only for data you care about) (17 of 20). Flag tables give defaults and allowed values for --mode, --target, --policy and --bug-detection; --variables and --session-context take free-form JSON (12 of 15). Examples throughout, exit-code tables and troubleshooting tables with named failures such as failed:setup_failed and RUN_ACTIVE. The README's run_end example names credits while the skill names credits_consumed (13 of 15). Semantic versions with a dated Keep a Changelog file and git tags (15).

BxPlaywright 41

Read with the local-software lines and graded as a pre-release. Official package on ForgeBox with BoxLang 1.17.0 or later, Java 21 and the supported platforms stated, but the only version is 1.0.0-snapshot, rebuilt from the development branch on 23 October 2026, with no binary hash on the entry (14 of 20). tests.yml runs 24 test files on Ubuntu and Windows with JDK 21, real-browser tests on Linux and a test of the full distribution, on pull requests, pushes to development and daily. Whether runs pass wasn't read, since WebFetch refused GitHub (15 of 25). Issues weren't readable for the same reason, bugs go to Ortus's Jira, and the repository is a month old, so there's no record to read (5 of 25). Keep a Changelog with semantic versioning stated and a written public contract, but nothing has been released under it and the changelog reads only [Unreleased] (7 of 15). Ortus announced 1.0 as generally available on 13 October, but no 1.0.0 build or tag exists, so it isn't 1.0 for this line (0 of 15). 14+15+5+7+0 = 41.

Kane CLI 50

Graded with the hosted lines, because every run, exploration and design job goes through TestMu AI's service and spends credits, and Exploration runs on HyperExecute. status.lambdatest.io (Statusfy) lists Kane CLI and KaneAI as their own components with incident history and an Atom feed (20). From 3 August to 1 November 2026 no incident names Kane CLI or KaneAI. The platform under it had test creation timeouts from 09:00 to 13:30 UTC on 28 September with slow Automation and HyperExecute starts, six hours of partial macOS HyperExecute degradation on 25 September, and real-device partial outages on 21 August and 22 October (57 minutes). Judgement call, 10 for multi-hour degradation of the service runs depend on. No request rate limit is published; the only numbers are Exploration's built-in limits (an hour, 400 actions or 800 model calls), 20 cloud browsers and a 15-minute real-device queue (5 of 15). No 429 or Retry-After guidance. maintain reconcile is documented as idempotent, Exploration refuses a second run with RUN_ACTIVE, and the skill says never to rerun a paid command just to get a support id (5 of 15). No SLA found; the terms weren't readable (0). Nothing in the repository labels Kane CLI or Exploration beta or preview (10).