BxPlaywright vs Puppeteer

BxPlaywright 41

Read with the local-software lines and graded as a pre-release. Official package on ForgeBox with BoxLang 1.17.0 or later, Java 21 and the supported platforms stated, but the only version is 1.0.0-snapshot, rebuilt from the development branch on 23 October 2026, with no binary hash on the entry (14 of 20). tests.yml runs 24 test files on Ubuntu and Windows with JDK 21, real-browser tests on Linux and a test of the full distribution, on pull requests, pushes to development and daily. Whether runs pass wasn't read, since WebFetch refused GitHub (15 of 25). Issues weren't readable for the same reason, bugs go to Ortus's Jira, and the repository is a month old, so there's no record to read (5 of 25). Keep a Changelog with semantic versioning stated and a written public contract, but nothing has been released under it and the changelog reads only [Unreleased] (7 of 15). Ortus announced 1.0 as generally available on 13 October, but no 1.0.0 build or tag exists, so it isn't 1.0 for this line (0 of 15). 14+15+5+7+0 = 41.

Puppeteer 80

Scored as local software. Official npm packages puppeteer and puppeteer-core at 25.16.0 (repository tag, 22 October 2026), with Node.js 22.12 or later stated in engines and a browser support table (20). Public CI runs Chrome and Firefox tests on Linux, macOS and Windows. Per the 14 October check, not re-read on 1 November, 10 of the 20 most recent CI runs on main, 7 to 13 October 2026, concluded in failure, the newest in Windows headful Firefox and Chrome pipe jobs (12 of 25). Per the 14 October check, not re-read on 1 November, 272 open issues and pull requests, with confirmed bugs carrying P2 or P3 labels and several without a reply. One of them, page.goto() ignoring its timeout after a second navigation, was fixed in 25.16.0 (18 of 25). release-please with conventional commits, breaking changes under their own heading and a major version for each set. None of the six releases since 25.13.0 marks a breaking change (15). Version 25, stable (15).

BxPlaywright 53

The snapshot build of 23 October 2026 is the latest published package, so 30 on time, though it isn't a release (30). No tagged releases or dated changelog entries in the 90 days, only one version rebuilt (0 of 20). 39 pull requests merged by Luis Majano between 30 September and 23 October. Issue replies couldn't be read and bugs go to Jira (10 of 25). Not in the official MCP registry, and the ForgeBox package has no stable version (5 of 15). Playwright for Java 1.63.0, Dependabot for Gradle monthly and Actions quarterly, a daily test run and a format check (8 of 10). 30+0+10+5+8 = 53.

Puppeteer 89

25.16.0 on 22 October 2026 (30). Twelve releases in the 90 days from 3 August, 25.5.0 on 4 August to 25.16.0 (20). Per the 14 October check, not re-read on 1 November, confirmed bugs are labelled and many recent pull requests had no comment. Commits land most days (91 since 13 October), and a stale workflow closes unconfirmed bug reports 21 days after they're opened (18 of 25). Current official npm packages, no MCP server to register (15). Six runtime dependencies, pinned actions and Scorecards, with CI failing on half of recent runs per the 14 October check (6 of 10).

BxPlaywright 66

Library reading. BoxLang is dynamically typed. The public API is listed in the docs' integrations page, help() and bxplaywright help --json describe it at run time, and the ten agent tools describe each argument in a sentence, with no published API reference (14 of 25). llms.txt with a Markdown copy of each of 18 docs pages (10). The AI page says when to use aiTools(), the registry or MCP, and when to turn registration off. Tool descriptions are one line each (13 of 20). Every agent-tool argument is a string, with no enums or limits; library options are checked, and InvalidOption lists the valid values (9 of 15). An errors page lists each error type with when it happens and the fix, eight runnable examples sit in the repository, and the docs have code on every page (13 of 15). Keep a Changelog and docs versioning on release, but no released version and no tags yet (7 of 15). 14+10+13+9+13+7 = 66.

Puppeteer 81

Graded as a library. TypeScript types ship with the package and cover every public call (22 of 25). No llms.txt (404 on 1 November) and no Markdown routes on pptr.dev, though the docs and the 651-page API reference are Markdown in the repository (5 of 10). TSDoc on each member with remarks and parameter descriptions. Guides explain when to use locators or page.$(), with few statements of when not to use a call (14 of 20). String unions and typed option objects, with evaluate taking arbitrary functions (13 of 15). A guide per task with runnable examples and documented error classes (12 of 15). Versioned releases and a changelog for each (15).

BxPlaywright 43

Library reading, as puppeteer and playwright-mcp were. No credential to leak and nothing to scope, so the middle band (20 of 30). Nothing is restricted by default. browser_visit takes any URL with no allow-list, browser_screenshot writes to any path the model passes, and the tools are added to bx-ai's global registry unless registerAiTools is false, so an agent given every registered tool gets a browser. Over MCP it starts Microsoft's server, which limits file access to workspace roots, and Ortus's plugin starts it with --headless but without --isolated, with browser_run_code_unsafe and browser_evaluate in the default set. HTTPS errors are not ignored by default (6 of 20). Page snapshots and text go to the model unfenced, and the docs give no prompt-injection guidance (0 of 15). Screenshot, trace and video policies, show-trace, and interception points such as onPageCreate and onPlaywrightArtifact give the operator a record, all off by default (10 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel; SECURITY.md points there. No security.txt (410, per the boxlang-ai check of the same day), no bounty, no advisories. Node.js downloads are checked against the release's SHA-256 list (7 of 20). 20+6+0+10+7 = 43.

Puppeteer 52

No credential to leak and nothing to scope, so the middle band (20 of 30). Chrome's sandbox stays on unless the script turns it off. Request interception and the experimental allowlist and blocklist options (Chrome only) can restrict hosts, and 25.15.0 added browser.restrictNetwork() to change them at run time. Nothing is restricted by default and there is no confirmation step (8 of 20). Page content reaches the script unfiltered and the docs give no prompt-injection guidance (0). Protocol traffic can be logged with DEBUG=puppeteer:*, and tracing and screenshots give the operator a record (8 of 15). SECURITY.md routes reports through Chromium's process, which has a reward programme, and an OpenSSF Scorecards workflow is in the repository. OSV lists one advisory, a 2020 use-after-free fixed in 1.13.0, and none since (16 of 20).