Hyperbrowser vs Kane CLI

Hyperbrowser 94

x402 version 2 on the vendor's own host for sessions, Fetch and Search, with USDC on Base and Solana. Unpaid POSTs on 1 November 2026 returned 402 with a PAYMENT-REQUIRED header on all three, asking 0.05 USDC for a session with the default 30 minutes, 0.001 for a fetch and 0.005 for a search. Scrape, Crawl, Extract, agent tasks and sandboxes need a key, so partial (34). Per-unit prices published without login (20). Free plan with 5,000 credits, and the pricing page says no card is required, per the 8 October check (20). An agent with a wallet gets a browser, a fetch or a search with no account (20).

Kane CLI 20

No x402, MPP or L402 (0). Plan prices are public per the listing check of 1 November 2026 (Starter $17 a month billed annually, Pro $89), and run_end reports credits per run, but the credit price per run isn't published, so plan-only pricing (10). The release says "free to start" and the check found a 10,000-credit, 30-day trial; whether it needs a card couldn't be read today. Judgement call (10 of 20). A person signs up and approves OAuth in a browser, or copies an access key from the dashboard, before any run (0).

Hyperbrowser 66

The platform is closed with published terms, the SDKs and MCP server are MIT and HyperAgent is AGPL-3.0 (20). The privacy notice of 24 October 2025 covers only the website. Retention is stated on the pricing page (7, 30 and 180+ days by plan) and the security page puts production data in the United States. No public DPA found (14). No deprecation policy found. The Python 1.0 migration guide keeps earlier request objects valid (5). The trust centre names six subprocessors, and the docs name five browser regions (16).

Kane CLI 38

The editorial half. The wrapper, skill and docs are Apache-2.0. The runner, assurance and pinned Node binaries are labelled Apache-2.0 on npm with no source in the linked repository, and the service terms couldn't be read (12 of 30). The repository says what leaves the machine. Every run uploads to Test Manager with screenshots and an evidence pack recording the user's name and email, secrets are masked, credentials are stored with mode 0600, and the evidence viewer reads packs locally. The privacy policy, DPA and retention periods are on testmuai.com and weren't read (10 of 30). The changelog calls out breaking changes, such as the removal of the bare-objective shortcut in 0.4.1, but there's no deprecation policy or dated notice period (5 of 20). The changelog describes telemetry (a remote log, support ids, errors spooled and sent at exit) and a daily npm update check. The opt-out KANE_TELEMETRY=0 appears only in a skill reference, not the user guide (8 of 20).

Hyperbrowser 65

Graded as a hosted API. hyperbrowser.betteruptime.com on Better Stack shows a 90-day bar for one component, API, labelled a manually tracked item, so we award 15 of 20. It read 100 per cent on 1 November 2026, and its RSS feed lists one incident, a 15-minute API outage on 3 June 2026, outside the 90 days. We award 25 of 30 because the item is tracked by hand. Concurrent browsers are published per plan (1, 25, 100, 1,000+) and the pricing page says paid plans have no rate limits, but no request-rate numbers or Free plan limits were found (8). 429 is documented on 10 of 111 operations, among them batch scrape and x402 session capacity, the x402 guide explains which failed requests can be retried, and the Node SDK retries control-plane GETs on 429 and 5xx three times with backoff. No Retry-After header or idempotency keys found (7). No SLA found (0). The API is version 1.0.0 and both SDKs are 1.x (10).

Kane CLI 50

Graded with the hosted lines, because every run, exploration and design job goes through TestMu AI's service and spends credits, and Exploration runs on HyperExecute. status.lambdatest.io (Statusfy) lists Kane CLI and KaneAI as their own components with incident history and an Atom feed (20). From 3 August to 1 November 2026 no incident names Kane CLI or KaneAI. The platform under it had test creation timeouts from 09:00 to 13:30 UTC on 28 September with slow Automation and HyperExecute starts, six hours of partial macOS HyperExecute degradation on 25 September, and real-device partial outages on 21 August and 22 October (57 minutes). Judgement call, 10 for multi-hour degradation of the service runs depend on. No request rate limit is published; the only numbers are Exploration's built-in limits (an hour, 400 actions or 800 model calls), 20 cloud browsers and a 15-minute real-device queue (5 of 15). No 429 or Retry-After guidance. maintain reconcile is documented as idempotent, Exploration refuses a second run with RUN_ACTIVE, and the skill says never to rerun a paid command just to get a support id (5 of 15). No SLA found; the terms weren't readable (0). Nothing in the repository labels Kane CLI or Exploration beta or preview (10).

Hyperbrowser 44

One x-api-key per account with no scopes or rotation guidance found (10). The x402 route needs no key and returns session-scoped tokens plus a managementToken that can only read or stop that session, which we credit 5. Connection tokens travel in the wsEndpoint URL and the MCP tools accept an apiKey argument, which we note without deducting because neither puts the account key in a documented URL. viewOnlyLiveView, a URL blocklist and sandbox network policies exist, with no read-only key (7). Pages are untrusted content and no prompt-injection guidance was found (0). rrweb recordings on by default, optional video and a live view give a per-session trail (11). SOC 2 Type 1 on request, annual third-party penetration tests and a Secureframe-monitored trust centre. No security.txt and no bug bounty found (11).

Kane CLI 55

Two credential routes. OAuth with browser consent and token revocation on logout, scopes not documented; or the account's username and access key, which the docs say lets anyone holding it run tests on the account, passed as a command-line flag in CI. Not in a URL. 20 of 30 for revocable credentials without documented scopes. Exploration's read_only policy blocks write requests to any host and never presses Delete, Sign out or Pay, with --deny, --allow-domain and --allow-post, and the first mutating run in a project asks once on a terminal. The default is mutating, with no confirmation in agent mode (12 of 20). Results include text from the page under test. The 0.10.0 content fence masks secrets before they leave the worker, but no prompt-injection guidance was found (2 of 15). Every run lands in Test Manager with screenshots, evidence packs record steps and logs, and Exploration findings keep a history naming who changed what (13 of 15). SECURITY.md with security@testmuai.com, signed and notarised binaries per the README, npm registry signatures. No bug bounty, certification or security.txt could be checked, since testmuai.com wasn't readable, and SECURITY.md's supported versions list only 0.1.x (8 of 20).

Hyperbrowser 72

Graded on the REST API. OpenAPI 3.0.1 at /docs/openapi.json with 101 paths and 111 operations on 1 November, up from 87 and 91 (25). llms.txt on the site and in the docs, with a Markdown twin of every page (10). 33 of 111 operations and 248 of 975 schema properties carry a description, up from 12 and 106 on 8 October, and the guides explain each product well (12). 225 schemas with 93 enums and ranges such as timeoutMinutes 1 to 720, and session creation has no free-form blobs apart from browserArgs (11). JavaScript and Python samples on most operations. 34 of 111 operations document no error response and the error body is a single message string (8). The spec is 1.0.0 with no version in the path, and the website changelog's newest entry was 18 November 2025 per the 8 October check, so dated changes are only visible through SDK tags (6).

Kane CLI 77

No OpenAPI or JSON Schema file. The NDJSON events are documented in typed Markdown tables, run_end is declared stable across versions, and each command family has its event list (10 of 25). Markdown docs in the repository, an agent skill and a context7.json for agents. The agents.md guide on testmuai.com wasn't readable and no llms.txt was checked (10). The user guide and skill say when to use run, testmd, testrun, assurance or Exploration, and when not (Exploration when there are no written requirements, read_only for data you care about) (17 of 20). Flag tables give defaults and allowed values for --mode, --target, --policy and --bug-detection; --variables and --session-context take free-form JSON (12 of 15). Examples throughout, exit-code tables and troubleshooting tables with named failures such as failed:setup_failed and RUN_ACTIVE. The README's run_end example names credits while the skill names credits_consumed (13 of 15). Semantic versions with a dated Keep a Changelog file and git tags (15).