Hyperbrowser vs Kernel

Hyperbrowser 44

One x-api-key per account with no scopes or rotation guidance found (10). The x402 route needs no key and returns session-scoped tokens plus a managementToken that can only read or stop that session, which we credit 5. Connection tokens travel in the wsEndpoint URL and the MCP tools accept an apiKey argument, which we note without deducting because neither puts the account key in a documented URL. viewOnlyLiveView, a URL blocklist and sandbox network policies exist, with no read-only key (7). Pages are untrusted content and no prompt-injection guidance was found (0). rrweb recordings on by default, optional video and a live view give a per-session trail (11). SOC 2 Type 1 on request, annual third-party penetration tests and a Secureframe-monitored trust centre. No security.txt and no bug bounty found (11).

Kernel 81

Scoped API keys with resource and action policies, project scoping and expiry, and OAuth 2.1 for MCP with project-limited tokens (30). Least privilege through scoped keys, a payment cap for cards through the MCP server and vault writes that need their own action (16). Pages an agent browses are untrusted, and we found no prompt-injection guidance in the docs read (4). Audit log search and export on Start-Up and above (13). SOC 2 Type II, HIPAA, PCI DSS and ISO 27001 on the security page and a HackerOne bounty (18). 30 + 16 + 4 + 13 + 18 = 81, before the deduction for the November 2026 incident.

Hyperbrowser 94

x402 version 2 on the vendor's own host for sessions, Fetch and Search, with USDC on Base and Solana. Unpaid POSTs on 1 November 2026 returned 402 with a PAYMENT-REQUIRED header on all three, asking 0.05 USDC for a session with the default 30 minutes, 0.001 for a fetch and 0.005 for a search. Scrape, Crawl, Extract, agent tasks and sandboxes need a key, so partial (34). Per-unit prices published without login (20). Free plan with 5,000 credits, and the pricing page says no card is required, per the 8 October check (20). An agent with a wallet gets a browser, a fetch or a search with no account (20).

Kernel 65

MPP on POST /mpp/browsers, a 402 challenge paid with a Stripe shared payment token through Link, covering one browser product only, not the API or MCP server (20). Per-second prices public without a login (20). The Developer plan is free with $5 of monthly credit, but whether signup needs a card wasn't stated on the pages read (10). Through MPP an agent gets a browser with no account or key, though a person approves each Link payment (15). 20 + 20 + 10 + 15 = 65.

Hyperbrowser 72

Graded on the REST API. OpenAPI 3.0.1 at /docs/openapi.json with 101 paths and 111 operations on 1 November, up from 87 and 91 (25). llms.txt on the site and in the docs, with a Markdown twin of every page (10). 33 of 111 operations and 248 of 975 schema properties carry a description, up from 12 and 106 on 8 October, and the guides explain each product well (12). 225 schemas with 93 enums and ranges such as timeoutMinutes 1 to 720, and session creation has no free-form blobs apart from browserArgs (11). JavaScript and Python samples on most operations. 34 of 111 operations document no error response and the error body is a single message string (8). The spec is 1.0.0 with no version in the path, and the website changelog's newest entry was 18 November 2025 per the 8 October check, so dated changes are only visible through SDK tags (6).

Kernel 93

OpenAPI at kernel.sh/openapi.json and per-endpoint Markdown reference (25). llms.txt with 423 entries and a Markdown twin for each page (10). Endpoint descriptions say when to use alternatives ("For interactive browsing, use GET /audit-logs", pools for bursty traffic) (17). Typed parameters with enums and limits such as memory sizes and timeout maximums (13). Code samples in TypeScript, Python and Go, and documented status codes such as 409 and 204 on pool acquire (13). A dated public changelog and SDK changelogs (15). 25 + 10 + 17 + 13 + 13 + 15 = 93.

Hyperbrowser 67

Fetch takes output formats, include and exclude selectors and a cache age, Search takes a page and filters, and the MCP server has 10 tools (20). Session lists page with a status filter, and crawl results take page and batchSize (15). Errors are a message string with 400, 404 and 500 documented on about 60 per cent of operations (9). No idempotency keys on session creation. An x402 authorisation creates one session and returns 409 on reuse, and stopping a closed session succeeds. The MCP tools carry no annotations (8). Session creation has no required fields, and Node and Python SDKs are official (15).

Kernel 84

Graded mainly on the API, with the MCP server noted. Responses are scoped per resource and the MCP server groups actions into about 32 tools (18). List endpoints page with limit and offset and filter by status (18). Typed SDK errors and documented 409 on concurrent changes, 204 on a pool timeout and 429 (17). Retrying an MPP purchase with the same credential returns the same browser, and the MCP tools carry readOnlyHint where read-only (16). SDKs in TypeScript, Python and Go plus a CLI, with defaults such as a 60-second timeout (15). 18 + 18 + 17 + 16 + 15 = 84.

Hyperbrowser 65

Graded as a hosted API. hyperbrowser.betteruptime.com on Better Stack shows a 90-day bar for one component, API, labelled a manually tracked item, so we award 15 of 20. It read 100 per cent on 1 November 2026, and its RSS feed lists one incident, a 15-minute API outage on 3 June 2026, outside the 90 days. We award 25 of 30 because the item is tracked by hand. Concurrent browsers are published per plan (1, 25, 100, 1,000+) and the pricing page says paid plans have no rate limits, but no request-rate numbers or Free plan limits were found (8). 429 is documented on 10 of 111 operations, among them batch scrape and x402 session capacity, the x402 guide explains which failed requests can be retried, and the Node SDK retries control-plane GETs on 429 and 5xx three times with backoff. No Retry-After header or idempotency keys found (7). No SLA found (0). The API is version 1.0.0 and both SDKs are 1.x (10).

Kernel 53

Hosted reading. status.kernel.sh on incident.io with a public incident feed (20). In the 90 days from 8 August it lists browser connection failures on 10 September (54 minutes, major), frozen popups on 1 October (71 minutes, major), elevated API errors on 19 October (4 minutes, critical), proxy failures on 23 October (65 minutes, major) and browser creation errors on 4 November (29 minutes, major), plus minor ones. Several majors, two of them an hour or more (0). Rate limits are per organisation with headers on every response, and concurrency is published per plan, but the create-rate numbers aren't (8). 429 with Retry-After, SDK retries with a typed error, safe retry with the same MPP credential and 409 on concurrent pool changes (15). The terms mention service levels in an order form but no public SLA was found (0). The API and MCP server carry no beta label (10). 20 + 0 + 8 + 15 + 0 + 10 = 53.

Hyperbrowser 79

Node SDK 1.4.1 and Python SDK 1.14.1 both tagged on 28 October 2026 (30). 20 Node and 27 Python SDK tags in the 90 days from 3 August (20). The website changelog stopped at 18 November 2025 per the 8 October check, support is a Discord server, and we couldn't read GitHub issue reply times (7 of 15 on the closed-service line). Current official SDKs in Node and Python. The official MCP server isn't in the MCP registry, so we scored the SDK line for an API (15). Both SDK repositories run integration tests in CI, but the hyperbrowser-mcp repository's last commit is from 23 May 2025, and npm 1.0.25 of 13 April 2025 pins SDK ^0.48.1 per the 8 October check (7).

Kernel 90

The changelog's latest entry is 16 October 2026 and the MCP server repository has commits on 6 November (30). More than three dated changes in 90 days, scoped keys, memory tiers, GPU tier and card payments among them (20). A closed service with a public changelog, Discord, email support and an open-source MCP server with 210 commits since 8 August (15). Official SDKs in three languages, and the MCP server in the registry as com.onkernel/kernel-mcp-server 1.1.0 (15). CI and tests in the MCP repository (10). 30 + 20 + 15 + 15 + 10 = 90.